security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-06-17 20:27:03 +02:00
Code Activity

Post release updates.

Browse Source 
--
This commit is contained in:
Werner Koch 2014-06-03 11:25:04 +02:00
parent 6209c6d9ad
commit 6d41c9b9ea
3 changed files with 48 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -1,3 +1,7 @@
Noteworthy changes in version 2.0.24 (unreleased)
-------------------------------------------------
Noteworthy changes in version 2.0.23 (2014-06-03) Noteworthy changes in version 2.0.23 (2014-06-03)
------------------------------------------------- -------------------------------------------------

83
announce.txt
View File

@ -5,9 +5,8 @@ Mail-Followup-To: gnupg-users@gnupg.org
Hello! Hello!
We are pleased to announce the availability of a new stable GnuPG-2 We are pleased to announce the availability of a new stable GnuPG-2
release: Version 2.0.22. This is a *security fix* release and all release: Version 2.0.23. This is a maintenace release with a few
users are advised to updated to this version. See below for the new features.
impact of the problem.
The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication
and data storage. It can be used to encrypt data, create digital and data storage. It can be used to encrypt data, create digital
@ -31,35 +30,33 @@ GnuPG is distributed under the terms of the GNU General Public License
also available for other Unices, Microsoft Windows and Mac OS X. also available for other Unices, Microsoft Windows and Mac OS X.
What's New in 2.0.22 What's New in 2.0.23
==================== ====================
* Fixed possible infinite recursion in the compressed packet * gpg: Reject signatures made using the MD5 hash algorithm unless the
parser. [CVE-2013-4402] new option --allow-weak-digest-algos or --pgp2 are given.
* Improved support for some card readers. * gpg: Do not create a trustdb file if --trust-model=always is used.
* Prepared building with the forthcoming Libgcrypt 1.6. * gpg: Only the major version number is by default included in the
armored output.
* Protect against rogue keyservers sending secret keys. * gpg: Print a warning if the Gnome-Keyring-Daemon intercepts the
communication with the gpg-agent.
* gpg: The format of the fallback key listing ("gpg KEYFILE") is now more
aligned to the regular key listing ("gpg -k").
Impact of the security problem * gpg: The option--show-session-key prints its output now before the
============================== decryption of the bulk message starts.
Special crafted input data may be used to cause a denial of service * gpg: New %U expando for the photo viewer.
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected.
Taylor R Campbell invented a neat trick to generate OpenPGP packages * gpgsm: Improved handling of re-issued CA certificates.
to force GPG to recursively parse certain parts of OpenPGP messages ad
infinitum. As a workaround a tight "ulimit -v" setting may be used to
mitigate the problem. Sample input data to trigger this problem has
not yet been seen in the wild. Details of the attack will eventually
be published by its inventor.
A fixed release of the GnuPG 1.4 series will be releases soon. * scdaemon: Various fixes for pinpad equipped card readers.
* Minor bug fixes.
@ -69,25 +66,26 @@ Getting the Software
Please follow the instructions found at http://www.gnupg.org/download/ Please follow the instructions found at http://www.gnupg.org/download/
or read on: or read on:
GnuPG 2.0.22 may be downloaded from one of the GnuPG mirror sites or GnuPG 2.0.23 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/gnupg/ . The list of mirrors direct from ftp://ftp.gnupg.org/gcrypt/gnupg/ . The list of mirrors
can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG can be found at http://www.gnupg.org/mirrors.html . Note that GnuPG
is not available at ftp.gnu.org. is not available at ftp.gnu.org.
On the FTP server and its mirrors you should find the following files On the FTP server and its mirrors you should find the following files
in the gnupg/ directory: in the gnupg/ directory:
gnupg-2.0.22.tar.bz2 (4200k) gnupg-2.0.23.tar.bz2 (4196k)
gnupg-2.0.22.tar.bz2.sig gnupg-2.0.23.tar.bz2.sig
GnuPG source compressed using BZIP2 and OpenPGP signature. GnuPG source compressed using BZIP2 and its OpenPGP signature.
gnupg-2.0.20-2.0.22.diff.bz2 (39k) gnupg-2.0.22-2.0.23.diff.bz2 (53k)
A patch file to upgrade a 2.0.20 GnuPG source tree. This patch A patch file to upgrade a 2.0.22 GnuPG source tree. This patch
does not include updates of the language files. does not include updates of the language files.
Note, that we don't distribute gzip compressed tarballs for GnuPG-2. Note, that we don't distribute gzip compressed tarballs for GnuPG-2.
A Windows version will eventually be released at https://gpg4win.org .
Checking the Integrity Checking the Integrity
@ -99,9 +97,9 @@ the following ways:
* If you already have a trusted version of GnuPG installed, you * If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the can simply check the supplied signature. For example to check the
signature of the file gnupg-2.0.22.tar.bz2 you would use this command: signature of the file gnupg-2.0.23.tar.bz2 you would use this command:
gpg --verify gnupg-2.0.22.tar.bz2.sig gpg --verify gnupg-2.0.23.tar.bz2.sig
This checks whether the signature file matches the source file. This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and You should see a message indicating that the signature is good and
@ -124,15 +122,15 @@ the following ways:
* If you are not able to use an old version of GnuPG, you have to verify * If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file the SHA-1 checksum. Assuming you downloaded the file
gnupg-2.0.22.tar.bz2, you would run the sha1sum command like this: gnupg-2.0.23.tar.bz2, you would run the sha1sum command like this:
sha1sum gnupg-2.0.22.tar.bz2 sha1sum gnupg-2.0.23.tar.bz2
and check that the output matches the first line from the and check that the output matches the first line from the
following list: following list:
9ba9ee288e9bf813e0f1e25cbe06b58d3072d8b8 gnupg-2.0.22.tar.bz2 c90e47ab95a40dd070fd75faef0a05c7b679553b gnupg-2.0.23.tar.bz2
6cc51b14ed652fe7eadae25ec7cdaa6f63377525 gnupg-2.0.21-2.0.22.diff.bz2 e02cfab2bc046f9fac89eef098c34f58b5745d20 gnupg-2.0.22-2.0.23.diff.bz2
Documentation Documentation
@ -143,11 +141,11 @@ Separate man pages are included as well; however they have not all the
details available in the manual. It is also possible to read the details available in the manual. It is also possible to read the
complete manual online in HTML format at complete manual online in HTML format at
http://www.gnupg.org/documentation/manuals/gnupg/ https://www.gnupg.org/documentation/manuals/gnupg/
or in Portable Document Format at or in Portable Document Format at
http://www.gnupg.org/documentation/manuals/gnupg.pdf . https://www.gnupg.org/documentation/manuals/gnupg.pdf .
The chapters on gpg-agent, gpg and gpgsm include information on how The chapters on gpg-agent, gpg and gpgsm include information on how
to set up the whole thing. You may also want search the GnuPG mailing to set up the whole thing. You may also want search the GnuPG mailing
@ -170,7 +168,7 @@ We suggest to send bug reports for a new release to this list in favor
of filing a bug at <http://bugs.gnupg.org>. We also have a dedicated of filing a bug at <http://bugs.gnupg.org>. We also have a dedicated
service directory at: service directory at:
http://www.gnupg.org/service.html https://www.gnupg.org/service.html
The driving force behind the development of GnuPG is the company of The driving force behind the development of GnuPG is the company of
its principal author, Werner Koch. Maintenance and improvement of its principal author, Werner Koch. Maintenance and improvement of
@ -178,7 +176,12 @@ GnuPG and related software takes up most of their resources. To allow
him to continue this work he kindly asks to either purchase a support him to continue this work he kindly asks to either purchase a support
contract, engage g10 Code for custom enhancements, or to donate money: contract, engage g10 Code for custom enhancements, or to donate money:
http://g10code.com/gnupg-donation.html Maintaining and improving GnuPG is costly. For more than a decade,
g10 Code GmbH, a German company owned and headed by GnuPG's principal
author Werner Koch, is bearing the majority of these costs. To help
them carry on this work, they need your support. See
https://gnupg.org/donate/
Thanks Thanks
@ -186,7 +189,7 @@ Thanks
We have to thank all the people who helped with this release, be it We have to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, administering the testing, coding, translating, suggesting, auditing, administering the
servers, spreading the word, or answering questions on the mailing servers, spreading the word, and answering questions on the mailing
lists. lists.

2
configure.ac
View File

@ -26,7 +26,7 @@ min_automake_version="1.10"
# (git tag -s gnupg-2.n.m) and run "./autogen.sh --force". Please # (git tag -s gnupg-2.n.m) and run "./autogen.sh --force". Please
# bump the version number immediately *after* the release and do # bump the version number immediately *after* the release and do
# another commit and push so that the git magic is able to work. # another commit and push so that the git magic is able to work.
m4_define([mym4_version], [2.0.23]) m4_define([mym4_version], [2.0.24])
# Below is m4 magic to extract and compute the git revision number, # Below is m4 magic to extract and compute the git revision number,
# the decimalized short revision number, a beta version string and a # the decimalized short revision number, a beta version string and a