Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to a gpg.fail retrospective covering 2003-era GnuPG code.
On oss-security, GnuPG lead developer Werner Koch replied to a retrospective published by the gpg.fail authors, citing a December 2003 commit in GnuPG's gettime.c affecting asctimestamp and printf format attributes in util.h. The excerpt contains no new CVE identifiers or exploitation evidence, and appears to revisit long-standing historical GnuPG code paths discussed by the retrospective's authors.
- Thread revisits a 2003 GnuPG commit in gettime.c, including asctimestamp and printf format attribute changes.
- Written by Werner Koch in response to a retrospective by the gpg.fail authors on oss-security.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb | time and that part of the code was simply forgotten: commit 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb Author: Werner Koch AuthorDate: Wed Dec 17 12:26:38 2003 +0 |
From the original article
Posted by Werner Koch on Sep 16 On Wed, 16 Sep 2026 02:27, Sam James said: Yes, sure. But 2003 was a different time and that part of the code was simply forgotten: commit 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb Author: Werner Koch AuthorDate: Wed Dec 17 12:26:38 2003 +0000 * gettime. c (asctimestamp): Add a note on a non-avoidable gcc warning.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.