Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.
A retrospective by the gpg.fail authors revealed a remote code execution vulnerability in gpgsm 2.4.9, triggered when invoked as "gpgsm --debug all --import" with a malicious certificate file. The researchers did not report the issue to GnuPG, leaving it unpatched as an apparent 0-day. Exposure appears limited since it requires importing untrusted certificates with debug options enabled.
- RCE affects gpgsm 2.4.9 via crafted certificate import
- Requires gpgsm --debug all --import with attacker-controlled input
- Never reported to GnuPG; no patch currently available
From the original article
Posted by Clemens Lang on Sep 14 Hi, I see two potential vulnerabilities discussed in this talk: (1) A RCE in `gpgsm` 2. 4. 9 when invoked as `gpgsm --debug all --import bad.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.