security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

gpg: Avoid using cached MD5 signature status.

Browse source 
* g10/sig-check.c (check_key_signature2): Avoid using a cached MD5
signature status.
* g10/keyring.c (keyring_get_keyblock): Ditto.
(write_keyblock): Ditto.

* g10/sig-check.c (do_check): Move reject warning to ...
* g10/misc.c (print_md5_rejected_note): new.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2014-10-11 19:41:51 +02:00
parent f952fe8c6d
commit 9112fed78b
4 changed files with 145 additions and 125 deletions
Download patch file Download diff file Expand all files Collapse all files

17
g10/sig-check.c
View file

@ -272,16 +272,7 @@ do_check( PKT_public_key *pk, PKT_signature *sig, gcry_md_hd_t digest,
if (sig->digest_algo == GCRY_MD_MD5
&& !opt.flags.allow_weak_digest_algos)
{
static int shown;
if (!shown)
{
log_info
(_("Note: signatures using the %s algorithm are rejected\n"),
"MD5");
shown = 1;
}
print_md5_rejected_note ();
return GPG_ERR_DIGEST_ALGO;
}
@ -549,9 +540,11 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
/* Check whether we have cached the result of a previous signature
check. Note that we may no longer have the pubkey or hash
needed to verify a sig, but can still use the cached value. A
cache refresh detects and clears these cases. */
cache refresh detects and clears these cases.
For safety reasons we ignore cache entries from MD5 signatures. */
if ( !opt.no_sig_cache ) {
if (sig->flags.checked) { /*cached status available*/
if (sig->flags.checked && sig->digest_algo != DIGEST_ALGO_MD5) {
/*cached status available*/
if( is_selfsig ) {
u32 keyid[2];