bugtraq - [SECURITY] [DSA 2946-1] python-gnupg security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 4 Jun 2014 18:55:29 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 2946-1] python-gnupg security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2946-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
June 04, 2014                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : python-gnupg
CVE ID         : CVE-2013-7323 CVE-2014-1927 CVE-2014-1928 CVE-2014-1929

Multiple vulnerabilities were discovered in the Python wrapper for the 
Gnu Privacy Guard (GPG). Insufficient sanitising could lead to the 
execution of arbitrary shell commands.

For the stable distribution (wheezy), these problems have been fixed in
version 0.3.6-1~deb7u1.

For the testing distribution (jessie), these problems have been fixed in
version 0.3.6-1.

For the unstable distribution (sid), these problems have been fixed in
version 0.3.6-1.

We recommend that you upgrade your python-gnupg packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTj0GeAAoJEBDCk7bDfE42aroQAJ75f7AJw24Ak+kOjP7G8bas
R3duqHp0TZVgIo4qlp/hH7Nv2wEtQVPzUcc2BjlZG/h8olfYnQfINZgBU/qVgXg3
AKYBhO/Vli/ZJO1svH9fJIKNxfzWclZuCqF/rrpd2t+sIxQmdANoV/U/rQ+eAHoS
RBPEgrHBsbL8IlufzJcdCE2K1IxFj+4ARuzsLKiZigCAZfg2L/p5W6x+SDPP5Yt0
hGCX/G76iSBwXsoievcPa43m+iGSLpphUankpsknZzfpBCx3vcrznpkP6Lt8S/Se
toyKBWXPWQMP77qf5wFxb31Xd/TSLJ+wZtK4Sl5pEOD25B4I59YcMlSxzNj/AGGs
R34jImIdAuCuVEP5oeq2bE4Ps0i0lbZwmDzJ9hNHhZ1lbs4CLehECWCFS0FYuqux
FgdXydAWcgLw9YOQM42jWg6m8kt3zzcrv9zjyC2wX/IQG3E8/h7q3I356Bw1wboQ
wX5GI5uaA1uNFq0fY3htbxEwN5J+skazVr0sns+JfQcPJtOtbM+L8HdJ6so+wpgr
crmbljhd/vpEQGI2UcF05zympdhP7ss4S/Sapn9c6Ws/XZl4JfUoaU6FKtUY7c/2
n/ZNfD/V9SxW7cgA0qQUm9NvOXa0BkynxyZ0aU/DrUEyvPWMQRU5qwraLU8noUHZ
gDxLHLrhunBSY+71FPg1
=0p3h
-----END PGP SIGNATURE-----