Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.
A retrospective by the gpg.fail authors revealed a remote code execution vulnerability in gpgsm 2.4.9, triggered when invoked as "gpgsm --debug all --import" with a malicious certificate file. The researchers did not report the issue to GnuPG, leaving it unpatched as an apparent 0-day. Exposure appears limited since it requires importing untrusted certificates with debug options enabled.
- RCE affects gpgsm 2.4.9 via crafted certificate import
- Requires gpgsm --debug all --import with attacker-controlled input
- Never reported to GnuPG; no patch currently available
Posted by Clemens Lang on Sep 14 Hi, I see two potential vulnerabilities discussed in this talk: (1) A RCE in `gpgsm` 2.4.9 when invoked as `gpgsm --debug all --import bad.cert`, with the bad.cert file at [1]. This is apparently a 0-day, as they say it was not reported to GnuPG. I’m not sure how widely used this code is, and how many users regularly call `gpgsm --import` with untrusted inputs. The researcher(s) say "if you're here to write a patch for the calc...
This source does not provide full text. Read it at seclists.org.