RHBA-2014:0806 - Bug Fix Advisory

Topic

Updated gnupg2 packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and
creating digital signatures, compliant with the proposed OpenPGP Internet
standard and the S/MIME standard.

This update fixes the following bugs:

• Previously, the secret key management daemon for GnuPG, gpg-agent, failed to

encode a new iteration count value when it created a new protected key or
changed an existing key. As a consequence, the key could not be unprotected and
gpg-agent thus did not properly interact with a number of programs that use key
decryption, such as KMail or Kleopatra. With this update, the new iteration
count is encoded properly and the decryption of keys created or modified by
gpg-agent no longer fails. (BZ#638635)

• Prior to this update, the GnuPG encryption and signing tool, gpg2, by default

used CAST5, an encryption algorithm not approved by FIPS standards.
Consequently, when gpg2 was run in FIPS mode, data encryption and decryption
failed and caused gpg2 to terminate unexpectedly. With this update, GnuPG uses
AES, a FIPS-approved encryption algorithm, and gpg2 data encryption and
decryption in FIPS mode work as intended. (BZ#966493)

• Previously, the GnuPG signature checking tool, gpgv2, did not correctly

interact with the Libgcrypt library. As a consequence, when the gpgv command was
used on a file, gpgv2 terminated unexpectedly. This update fixes the error and
the gpgv command now functions correctly. (BZ#1006879)

• Prior to this update, GnuPG did not check for availability of the RIPEMD-160

hash function digest. Because the RIPEMD-160 algorithm is not approved by FIPS
standards, GnuPG therefore terminated unexpectedly when the "gpg --verify"
command was used in FIPS mode to verify a signature that contained a RIPEMD-160
hash. With this update, GnuPG properly checks for RIPEMD-160 support and the
crash no longer occurs. (BZ#1078957)

Users of gnupg2 are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 638635 - gpg-agent fails to encode "iteration count" into private keys, thus never unprotects secret key
• BZ - 966493 - symmetric encryption/decryption doesn't work in FIPS mode
• BZ - 1078957 - gpg --verify coredumps when verifying a signature with RIPEMD160 digest in FIPS mode

CVEs

(none)

References

(none)