CVE-2025-30258 (was: [Announce] GnuPG 2.5.5 released)

Am Freitag 07 März 2025 15:21:21 schrieb Werner Koch via Gnupg-users: >   * gpg: Fix a verification DoS due to a malicious subkey in the >     keyring.  [T7527] Someone assigned a low/medium CVE number for this vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2025-30258 As 2.4 stable has go

Re: What is Werner's key?

On Tue, 25 Mar 2025 09:30:50 +0100 Werner Koch via Gnupg-users wrote: > On Sun, 23 Mar 2025 18:07, Frank Guthausen said: > > > $ gpg --list-keys --with-fingerprint --with-fingerprint | grep -B2 > > "8777 461F 2A07 4EBC 480D 3594 19CC 1C9E 085B 107A" > > gpg --fingerprint > > is much easier

on "vulnerabilities" (Re: CVE-2025-30258 (was: [Announce] GnuPG 2.5.5 released))

Am Dienstag 25 März 2025 15:11:07 schrieb Bernhard Reiter via Gnupg-users: > omeone assigned a low/medium CVE number for this vulnerability: To clarify, I wrote While by common definitions, this defect is a software vulnerability, the low CVSSv3 (2.7 by Redhat) shows that it is not something whi

Re: What is Werner's key?

On Sun, 23 Mar 2025 18:07, Frank Guthausen said: > $ gpg --list-keys --with-fingerprint --with-fingerprint | grep -B2 > "8777 461F 2A07 4EBC 480D 3594 19CC 1C9E 085B 107A" gpg --fingerprint is much easier to remember and is actually one of the oldest gpg commands. However, the old human reada