USN-9087-1: signing-party vulnerability

Q: Who is exposed to this issue?

Users who run the gpg-key2ps tool and process OpenPGP keys are exposed. Exploitation requires the user to be tricked into processing a specially crafted key.

Q: What could an attacker achieve?

An attacker could possibly execute arbitrary commands by supplying an OpenPGP key containing a crafted user ID.

Published Nov 12, 2026

Updated

It was discovered that the gpg-key2ps tool in signing-party did not properly sanitize user IDs before passing them to a shell. If a user were tricked into processing a specially crafted OpenPGP key, an attacker could possibly use this issue to execute arbitrary commands.

Affected Software

4 affected componentsFixes available

All of the following

ubuntu/signing-party<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/signing-party<2.2-1ubuntu0.1~esm1

2.2-1ubuntu0.1~esm1

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/signing-party to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/signing-party to a version that resolves this vulnerability.
Fixed in 2.2-1ubuntu0.1~esm1

Event History

Nov 12, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-11627

Frequently Asked Questions

Who is exposed to this issue?