Advisories » MGASA-2019-0386

Updated signing-party packages fix security vulnerability

Publication date: 14 Dec 2019
Modification date: 14 Dec 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-11627

Description

Updated signing-party package fixes security vulnerability:

The gpg-key2ps tool in signing-party contained an unsafe shell call
enabling shell injection via a User ID (CVE-2019-11627).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25742
• https://lists.opensuse.org/opensuse-updates/2019-05/msg00085.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11627

SRPMS

7/core

• signing-party-2.10-1.mga7