Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to a gpg.fail retrospective covering 2003-era GnuPG code.
On oss-security, GnuPG lead developer Werner Koch replied to a retrospective published by the gpg.fail authors, citing a December 2003 commit in GnuPG's gettime.c affecting asctimestamp and printf format attributes in util.h. The excerpt contains no new CVE identifiers or exploitation evidence, and appears to revisit long-standing historical GnuPG code paths discussed by the retrospective's authors.
- Thread revisits a 2003 GnuPG commit in gettime.c, including asctimestamp and printf format attribute changes.
- Written by Werner Koch in response to a retrospective by the gpg.fail authors on oss-security.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha1 | 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb | time and that part of the code was simply forgotten: commit 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb Author: Werner Koch AuthorDate: Wed Dec 17 12:26:38 2003 +0 |
Posted by Werner Koch on Sep 16 On Wed, 16 Sep 2026 02:27, Sam James said: Yes, sure. But 2003 was a different time and that part of the code was simply forgotten: commit 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb Author: Werner Koch AuthorDate: Wed Dec 17 12:26:38 2003 +0000 * gettime.c (asctimestamp): Add a note on a non-avoidable gcc warning. * util.h [!HAVE_VASPRINTF]: Add printf format attribute to the replacement...
This source does not provide full text. Read it at seclists.org.