-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
--------------------------------------------------------------------------
Turbolinux Security Advisory TLSA-2003-34
http://www.turbolinux.co.jp/security/
security-team@turbolinux.co.jp
--------------------------------------------------------------------------
Original released date : 30 May 2003
Last revised : 30 May 2003
Package : gnupg
Summary : Key validity bug in GnuPG
More information :
GnuPG is a complete and free replacement for PGP.
GnuPG is a RFC2440 (OpenPGP) compliant application.
This bug causes keys with more than one user ID to give all user IDs
on the key the amount of validity given to the most-valid key.
Impact :
A user encrypting a message using GnuPG may not be warned if the target
user key being encrypted to has an "insufficient or no trust path".
Affected Products :
- Turbolinux 8 Server
- Turbolinux 8 Workstation
- Turbolinux 7 Server
- Turbolinux 7 Workstation
- Turbolinux Server 6.5
- Turbolinux Workstation 6.0
Solution :
Please use turbopkg tool to apply the update.
<Turbolinux 8 Server>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 6fe5c465893ee5460fb1fdb6b140c3b9
Binary Packages
Size : MD5
gnupg-1.0.7-3.i586.rpm
885860 7d908478b8a2bc607472f84f57d9f07f
<Turbolinux 8 Workstation>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 9fa9bbe40083725ef004e13b23d00d81
Binary Packages
Size : MD5
gnupg-1.0.7-3.i586.rpm
885799 b948454e477791c9ace7143fb5b9e686
<Turbolinux 7 Server>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 63cab8022f8ee40158c0c73028ef8688
Binary Packages
Size : MD5
gnupg-1.0.7-3.i586.rpm
862428 705c9716aecb3672d6f6181dd59da3a5
<Turbolinux 7 Workstation>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 b3f2fe9e597a3c5fa85dd7e06a791656
Binary Packages
Size : MD5
gnupg-1.0.7-3.i586.rpm
863379 3df65ff140fe7e0a4fb6d0d032705591
<Turbolinux Server 6.5>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 c2fb479f05eb84dd69304d748d88c5e4
Binary Packages
Size : MD5
gnupg-1.0.7-3.i386.rpm
1170653 c2651ea589a02bca72e84788ba1da7e0
<Turbolinux Workstation 6.0>
Source Packages
Size : MD5
gnupg-1.0.7-3.src.rpm
2409027 ecae521c662ba0a9ecf7d92666f89a9a
Binary Packages
Size : MD5
gnupg-1.0.7-3.i386.rpm
1166484 24482155f6e46a61d4942804740381a4
notice :
It is different on trustdb format from 'the GnuPG 1.0.6 or earlier version'
and 'the 1.0.7 and later version'.
You need to execute the /usr/bin/convert-from-106 script to convert
the trustdb, if you use the GnuPG.
If the following messages shown up, change 'honor-http-proxy' to
'keyserver-options honor-http-proxy' in ~/.gnupg/gpg.conf or
~/.gnupg/options files.
--------------------------------------------------------------
gpg: WARNING: --honor-http-proxy is a deprecated option.
gpg: please use "--keyserver-options honor-http-proxy" instead
--------------------------------------------------------------
References :
gnupg-announce
http://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000268.html
http://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000267.html
--------------------------------------------------------------------------
Revision History
30 May 2003 Initial release
--------------------------------------------------------------------------
Copyright(C) 2003 Turbolinux, Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+1zodK0LzjOqIJMwRAvSkAJ0SQcB9MZS5WS8fYboOEDC6U5kEbwCdFZ0G
U/tLRYvWnwt758R984oeers=
=SeC6
-----END PGP SIGNATURE-----
