Issued:

2014-06-30

Updated:

2014-10-13

RHBA-2014:0806 - gnupg2 bug fix update

Synopsis

gnupg2 bug fix update

Type/Severity

Bug Fix Advisory

Topic

Updated gnupg2 packages that fix several bugs are now available for Red Hat Enterprise Linux 6.

Description

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard.

This update fixes the following bugs:

• Previously, the secret key management daemon for GnuPG, gpg-agent, failed to encode a new iteration count value when it created a new protected key or changed an existing key. As a consequence, the key could not be unprotected and gpg-agent thus did not properly interact with a number of programs that use key decryption, such as KMail or Kleopatra. With this update, the new iteration count is encoded properly and the decryption of keys created or modified by gpg-agent no longer fails. (BZ#638635)

• Prior to this update, the GnuPG encryption and signing tool, gpg2, by default used CAST5, an encryption algorithm not approved by FIPS standards. Consequently, when gpg2 was run in FIPS mode, data encryption and decryption failed and caused gpg2 to terminate unexpectedly. With this update, GnuPG uses AES, a FIPS-approved encryption algorithm, and gpg2 data encryption and decryption in FIPS mode work as intended. (BZ#966493)

• Previously, the GnuPG signature checking tool, gpgv2, did not correctly interact with the Libgcrypt library. As a consequence, when the gpgv command was used on a file, gpgv2 terminated unexpectedly. This update fixes the error and the gpgv command now functions correctly. (BZ#1006879)

• Prior to this update, GnuPG did not check for availability of the RIPEMD-160 hash function digest. Because the RIPEMD-160 algorithm is not approved by FIPS standards, GnuPG therefore terminated unexpectedly when the "gpg --verify" command was used in FIPS mode to verify a signature that contained a RIPEMD-160 hash. With this update, GnuPG properly checks for RIPEMD-160 support and the crash no longer occurs. (BZ#1078957)

Users of gnupg2 are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Affected Products

Updated Packages

• gnupg2-debuginfo-2.0.14-8.el6.ppc64.rpm
• gnupg2-smime-2.0.14-8.el6.i686.rpm
• gnupg2-smime-2.0.14-8.el6.x86_64.rpm
• gnupg2-debuginfo-2.0.14-8.el6.i686.rpm
• gnupg2-2.0.14-8.el6.x86_64.rpm
• gnupg2-2.0.14-8.el6.src.rpm
• gnupg2-2.0.14-8.el6.ppc64.rpm
• gnupg2-2.0.14-8.el6.i686.rpm
• gnupg2-smime-2.0.14-8.el6.ppc64.rpm
• gnupg2-debuginfo-2.0.14-8.el6.s390x.rpm
• gnupg2-smime-2.0.14-8.el6.s390x.rpm
• gnupg2-2.0.14-8.el6.s390x.rpm
• gnupg2-debuginfo-2.0.14-8.el6.x86_64.rpm

Fixes

• This content is not included.BZ - 638635
• This content is not included.BZ - 966493
• This content is not included.BZ - 1078957

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.