3 ms·
I like how this vulnerability report gives a reasonable set of actions for mitigations: For Users Remove verbose from gpg.conf, if you have it. Do not
by mkesper 8y ago
I like how this vulnerability report gives a reasonable set of actions for mitigations:
For Users
Remove verbose from gpg.conf, if you have it.
Do not use gpg --verbose on the command line.
Upgrade to GnuPG 2.2.8 or GnuPG 1.4.23
Upgrade to Enigmail 2.0.7
Upgrade to GPGTools 2018.3
For developers
Upgrade to python-gnupg 0.4.3
Call gpg with --no-verbose to disable the attack.
Use a dedicated pipe for --status-fd, and do not share it with stderr.
If this is not easy (or even possible) due to the framework or target platform, consider --batch --log-file FILE to redirect the stderr output, where FILE can be /dev/null, too. Thanks to Patrick Brunschwig for this idea!
Or, the --status-file FILE option could be used to direct the status lines to a temporary file.