What's New
===========
* Fixed possible infinite recursion in the compressed packet
parser. [CVE-2013-4402]
* Protect against rogue keyservers sending secret keys.
* Use 2048 bit also as default for batch key generation.
* Minor bug fixes.
Impact of the security problem
==============================
Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected.
Taylor R. Campbell invented a neat trick to generate OpenPGP packages
to force GPG to recursively parse certain parts of OpenPGP messages ad
infinitum. As a workaround a tight "ulimit -v" setting may be used to
mitigate the problem. Sample input data to trigger this problem has
not yet been seen in the wild. Details of the attack will eventually
be published by its inventor.
A fixed release of the GnuPG 2.0 series has also been released.
Signed-off-by: Jack Nagel <jacknagel@gmail.com>
- Adjust CFLAGS to preserve building with clang
- Remove the patch, which fails to apply. It was not submitted upstream
prior to the 1.4.12 release; users who need this patch preserved
should see that it is sent to the GnuPG maintainer. We will consider
carrying it again once that is done.
Signed-off-by: Jack Nagel <jacknagel@gmail.com>
Although it is technicaly possible to work with 8192 bit GPG keys the
creators of Gnupgp ship the sources with a hard coded limit of 4096
bit. If you want a larger GPG key than 4096 bit you're supposed to
change the given limit yourself by changing one line of code in the file
g10/keygen.c. That's it. After that you can create 8192 bit GPG keys.
ClosesHomebrew/homebrew#4201.
Signed-off-by: Mike McQuaid <mike@mikemcquaid.com>
brewkit.rb changes ENV destructively, so lets not do that everytime a formula
is required. Now it's possible for other tools to require a formula
description without worrying about side-effects.
