Hello!
We are pleased to announce the availability of a new stable GnuPG-1
release: Version 1.4.17. This release includes a *security fix* to stop
a possible DoS using garbled compressed data packets which can be used
to put gpg into an infinite loop.
The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and
data storage. It is a complete and free replacement of PGP and can be
used to encrypt data and to create digital signatures. It includes an
advanced key management facility, smartcard support and is compliant
with the OpenPGP Internet standard as described by RFC-4880. GnuPG is
distributed under the terms of the GNU General Public License (GPLv3+).
Note that this version is from the GnuPG-1 series and thus smaller than
those from the GnuPG-2 series, easier to build, and also better portable
to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.23) it
comes with no support for S/MIME, Secure Shell, or other tools useful
for desktop environments. Fortunately you may install both versions
alongside on the same system without any conflict.
What's New
===
* Avoid DoS due to garbled compressed data packets.
* Screen keyserver reponses to avoid import of unwanted keys by rogue
servers.
* Add hash algorithms to the sig records of the colon output.
* More specific reason codes for INV_RECP status.
* Fixes for PC/SC access on Apple.
* Minor bug fixes.
Getting the Software
First of all, decide whether you really need GnuPG version 1.4.x - most
users are better off with the modern GnuPG 2.0.x version. Then follow
the instructions found at https://www.gnupg.org/download/ or read on:
GnuPG 1.4.17 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be
found at https://www.gnupg.org/mirrors.html . Note, that GnuPG is not
available at ftp.gnu.org.
On ftp.gnupg.org and on its mirrors you should find the following new
files in the *gnupg* directory:
- The GnuPG source code compressed using BZIP2 and its OpenPGP
signature:
gnupg-1.4.17.tar.bz2 (3563k)
gnupg-1.4.17.tar.bz2.sig
- The GnuPG source code compressed using GZIP and its OpenPGP
signature:
gnupg-1.4.17.tar.gz (4929k)
gnupg-1.4.17.tar.gz.sig
- A patch file to upgrade a 1.4.16 GnuPG source tree. This patch does
not include updates of the language files.
gnupg-1.4.16-1.4.17.diff.bz2 (21k)
Select one of them. To shorten the download time, you probably want to
get the BZIP2 compressed file. Please try another mirror if exceptional
your mirror is not yet up to date.
In the *binary* directory, you should find these files:
- GnuPG compiled for Microsoft Windows and its OpenPGP signature.
This is a command line only version; the source files are the same
as above.
gnupg-w32cli-1.4.17.exe (1574k)
gnupg-w32cli-1.4.17.exe.sig
Note, that this is a minimal installer and unless you are only in need
for the simple the gpg binary, you are better off using the full
featured installer at https://www.gpg4win.org .
Checking the Integrity
==
In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:
* If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the
signature of the file gnupg-1.4.17.tar.bz2 you would use this command:
gpg --verify gnupg-1.4.17.tar.bz2.sig
This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and
made by that signing key. Make sure that you have the right key,
either by checking the fingerprint of that key with other sources
or by checking that the key has been signed by a trustworthy other
key. Note, that you can retrieve the signing key using the command
finger wk ,at' g10code.com | gpg --import
or using a keyserver like
gpg --recv-key 4F25E3B6
The distribution key 4F25E3B6 is signed by the well known key
1E42B367. If you get an key expired message, you should retrieve a
fresh copy as the expiration date might have been prolonged.
NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE
INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION!
* If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.17.tar.bz2, you would run the sha1sum command like this:
sha1sum gnupg-1.4.17.tar.bz2
and check that the output matches the first line from the
following list:
830c7f749ad92d6577c521addea5e5d920128d42 gnupg-1.4.17.tar.bz2
d5b3c25901f182ea20c31f09669f44681c3aaa89 gnupg-1.4.17.tar.gz
ff761de4efc3876c57199612c24b677208da7c10 gnupg-1.4.16-1.4.17.diff.bz2
b2f0db9eebf028d27d0a119334e5e357773dd0d6
