Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to the gpg.fail authors' retrospective, addressing format-nonliteral handling in time string formatting.
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #gnupg
Re: Retrospective by 'gpg.fail' authors
oss-security thread on the gpg.fail retrospective discusses legacy code removal and flaws surfaced by frontier AI models in open-source projects.
Re: Retrospective by 'gpg.fail' authors
oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.
Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to a gpg.fail retrospective covering 2003-era GnuPG code.
Re: Retrospective by 'gpg.fail' authors
Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.
Re: Retrospective by 'gpg.fail' authors
GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.
Re: Retrospective by 'gpg.fail' authors
GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.
Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.
Retrospective by 'gpg.fail' authors
Authors of the gpg.fail GnuPG vulnerability set published a retrospective with talk recording, slides, and a repo PoC.
The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]
A conference talk recounts GPG vulnerability disclosures, notes several GnuPG flaws remain unpatched, and demonstrates novel bugs live.