USN-3733-2: GnuPG vulnerability
USN-3733-1 fixed a vulnerability in GnuPG. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that GnuPG is vulnerable to a cache side-channel attack. A local attacker could use this attack to recover RSA private keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gnupg-curlto a version that resolves this vulnerability.Fixed in 1.4.11-3ubuntu2.12 - Upgrade
Upgrade
ubuntu/gpgvto a version that resolves this vulnerability.Fixed in 1.4.11-3ubuntu2.12 - Upgrade
Upgrade
ubuntu/gnupgto a version that resolves this vulnerability.Fixed in 1.4.11-3ubuntu2.12 - Upgrade
Upgrade
GnuPGto a version that resolves this vulnerability.Patch USN-3733-1 - Upgrade
Upgrade
GnuPGto a version that resolves this vulnerability.Patch USN-3733-2
Event History
Frequently Asked Questions
What is the vulnerability ID USN-3733-2 related to?
USN-3733-2 addresses a vulnerability in GnuPG affecting the Ubuntu 12.04 ESM version.
What are the affected packages for USN-3733-2?
The affected packages for USN-3733-2 include gnupg, gpgv, and gnupg-curl, all of which must be updated to version 1.4.11-3ubuntu2.12.
How do I fix the vulnerability USN-3733-2?
To fix vulnerability USN-3733-2, update the affected packages gnupg, gpgv, and gnupg-curl to version 1.4.11-3ubuntu2.12.
What severity rating has been assigned to USN-3733-2?
The severity of vulnerability USN-3733-2 is considered important due to its potential impact on system security.
Are there any available patches for USN-3733-2?
Yes, patches are available in the Ubuntu repositories for USN-3733-2 that resolve the identified vulnerability.