Synopsis

Moderate: gnupg2 security update

Type/Severity

Security Advisory: Moderate

Topic

An updated gnupg2 package that fixes one security issue is now available
for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and
creating digital signatures, compliant with the proposed OpenPGP Internet
standard and the S/MIME standard.

A use-after-free flaw was found in the way gpgsm, a Cryptographic Message
Syntax (CMS) encryption and signing tool, handled X.509 certificates with
a large number of Subject Alternate Names. A specially-crafted X.509
certificate could, when imported, cause gpgsm to crash or, possibly,
execute arbitrary code. (CVE-2010-2547)

All gnupg2 users should upgrade to this updated package, which contains a
backported patch to correct this issue.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 618156 - CVE-2010-2547 GnuPG 2: use-after-free when importing certificate with many alternate names

CVEs

• CVE-2010-2547

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
x86_64
gnupg2-2.0.10-3.el5_5.1.x86_64.rpm	SHA-256: de63905e286914a43cfed8ec6ddabef7d261396e0bc744f1bfdb6eefbe258bfb
ia64
gnupg2-2.0.10-3.el5_5.1.ia64.rpm	SHA-256: 45cc03a83989cb34b1bec08052352a53a61a6dbb7b448e86a9e547a3923e6f81
i386
gnupg2-2.0.10-3.el5_5.1.i386.rpm	SHA-256: 1c19c285082fafcd2a1892dcab76122d626f49692352aa0448f1c0a746bece73

Red Hat Enterprise Linux Workstation 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
x86_64
gnupg2-2.0.10-3.el5_5.1.x86_64.rpm	SHA-256: de63905e286914a43cfed8ec6ddabef7d261396e0bc744f1bfdb6eefbe258bfb
i386
gnupg2-2.0.10-3.el5_5.1.i386.rpm	SHA-256: 1c19c285082fafcd2a1892dcab76122d626f49692352aa0448f1c0a746bece73

Red Hat Enterprise Linux Desktop 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
x86_64
gnupg2-2.0.10-3.el5_5.1.x86_64.rpm	SHA-256: de63905e286914a43cfed8ec6ddabef7d261396e0bc744f1bfdb6eefbe258bfb
i386
gnupg2-2.0.10-3.el5_5.1.i386.rpm	SHA-256: 1c19c285082fafcd2a1892dcab76122d626f49692352aa0448f1c0a746bece73

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
s390x
gnupg2-2.0.10-3.el5_5.1.s390x.rpm	SHA-256: 6ab472642f96bcce879c4e0a54a6ccca6a0d1f274b359e051546a1245a50c52c

Red Hat Enterprise Linux for Power, big endian 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
ppc
gnupg2-2.0.10-3.el5_5.1.ppc.rpm	SHA-256: f4e564466a6d1cd27278e11fd1c85212b03048f377b73d1d353b47acb078d5d0

Red Hat Enterprise Linux Server from RHUI 5

SRPM
gnupg2-2.0.10-3.el5_5.1.src.rpm	SHA-256: a612cf391982ba66cbaccd4a226f23327afc0c4099e7d5470879ddec0d0199f0
x86_64
gnupg2-2.0.10-3.el5_5.1.x86_64.rpm	SHA-256: de63905e286914a43cfed8ec6ddabef7d261396e0bc744f1bfdb6eefbe258bfb
i386
gnupg2-2.0.10-3.el5_5.1.i386.rpm	SHA-256: 1c19c285082fafcd2a1892dcab76122d626f49692352aa0448f1c0a746bece73