Conversation

Item 5: Memory Corruption in ASCII-Armor Parsing

This is a serious memory-safety error in GPG.

Yes, and actually the only serious bug from their list. This one (T7906) was fixed in the repo on November 4 (T7906) and released with 2.5.14 on 2025-11-19:

  • gpg: Fix possible memory corruption in the armor parser. [T7906]

and in the ExtendedLTS version 2.2.51 already on: 2025-10-28:

  • gpg: Fix possible memory corruption in the armor parser.
    [rG1e929abd20]

Another release of 2.4 is still pending but given that its end-of-life is in 6 months, it would anyway better to switch to 2.5.

~ Werner Koch, gpg maintainer

2.4 is the version most distributions ship. 2.4 is NOT END OF LIFE YET. 2.4 is the version that is offered as "GnuPG" when downloading it from gnupg.org.

not fixing an exploitable memory corruption that can lead to remote code execution in a cryptography tool that often processes content transmitted over http is everything you need to know about werner koch.

stop using gpg. https://gpg.fail

2
3
0

@49016 only backporting a probable security vulnerability to the versions that paying customers (assuming that's what"Extended Long Term Support contract available." means) is really funny

1
0
0

@5225225 @49016 gnu “pay us to have a security bug fixed caused by us writing the software in a memory-unsafe language” privacy “or deal with an unstable development version” guard

0
3
10

@49016@catgirl.cloud Are sequoia maintainers more responsible?

0
0
0