← Feed

Posts

• Post #2069092

  For those with an @lwn subscription, https://lwn.net/Articles/1054220/ "Responses to gpg.fail" by Joe Brockmeier (January 21, 2026) is available now. Others will have to wait a few days (until 2026-01-29) There is a good discussion in the comments. Important takeaway: Do not use "cleartext" signatures (where the signature is in the file itself) and if you must be _extra_ careful when verifying these.

• Post #2069088

  Dear GnuPG packagers and builders, please upgrade libgcrypt to v1.12.2 to remove a denial of service vulnerability (estimated CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H -- 7.5 (HIGH)) Releases of other stable versions of libgcrypt are available as well. (GnuPG versions >= 2.5.7 are not affected due to the use of a different encryption API.) See https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html for details. #GnuPG #EndtoEndCrypto #FreeSoftware #LibrePGP

• Post #1718845

  When looking at the changes towards the new 2.5.19 version of #GnuPG, there are many small things; like a way to use OCB for symmetric-only encryption, a few defect fixes and improvements. Not that exciting, but maintenance of the well known #LibrePGP, OpenPGPv4 and CMS capable crypto engine.... you may want to know anyhow. ;) https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html https://dev.gnupg.org/T7998 #GnuPG #EndtoEndCrypto #FreeSoftware

• Post #453861

  Details about the (ongoing) response to https://gpg.fail/ from GnuPG's side: * https://www.gnupg.org/blog/20251226-cleartext-signatures.html * https://dev.gnupg.org/T7906 Memory Corruption in ASCII-Armor Parsing * https://dev.gnupg.org/T7900 (overview) Please upgrade to GnuPG 2.5.16, 2.4.9 or #Gpg4win 5.0.0-beta479 which already have the fix for what (currently) is seen to be the only major defect: T7906. (Researchers - Thanks! - found defects in GnuPG, Sequoia-PG, Minisign and a...