Skip to content

Handle GnuPG 2.4.9#415

Open
puck wants to merge 1 commit intobestpractical:5.0-trunkfrom
puck:fix-gnupg-2.4.9
Open

Handle GnuPG 2.4.9#415
puck wants to merge 1 commit intobestpractical:5.0-trunkfrom
puck:fix-gnupg-2.4.9

Conversation

@puck
Copy link
Contributor

@puck puck commented Mar 20, 2026

GnuPG 2.4.9 fixes possible memory corruption in armor parsing[0] it appears that this has also changed the warnings emitted. This test now fails:

  t/seecurity/CVE-2012-4735-incoming-encryption-header.t .. # GnuPG --homedir /tmp/xqR91djkdB
  ok 1 - created a ticket
  ok 2 - loaded ticket
  ok 3 - Found the right attachment
  ok 4 - Incoming encryption header is removed
  ok 5 - Incoming signature header is removed
  ok 6 - created a ticket
  ok 7 - GnuPG warning
  ok 8 - GnuPG warning
  not ok 9 - GnuPG warning

  #   Failed test 'GnuPG warning'
  #   at t/security/CVE-2012-4735-incoming-encryption-header.t line 65.
  #                   'Failure during GnuPG gpg-exit: Failed to gpg-exit
  # '
  #     doesn't match '(?^:Failure during GnuPG data: No data has been found\. The reason is 'No armored data')'
  ok 10 - loaded ticket
  ok 11 - Found the right attachment
  ok 12 - Incoming encryption header is removed
  ok 13 - Incoming signature header is removed
  ok 14 - no warnings
  1..14

These are the warnings emitted:

  $VAR1 = [
            'gpg: keybox \'/tmp/rRZPP1xcq3/pubring.kbx\' created
  gpg: invalid radix64 character 5F skipped
  gpg: invalid radix64 character 5F skipped
  gpg: invalid radix64 character 2E skipped
  gpg: [don\'t know]: invalid packet (ctb=4e)
  ',
            'Failure during GnuPG data: No data has been found. The reason is \'Invalid packet found\'
  ',
            'Failure during GnuPG gpg-exit: Failed to gpg-exit
  '
          ];

Let's only look for the 'No armored data' on < 2.4.9.

Reported in Debian as part of our regular QA processes:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130943

[0] https://github.com/gpg/gnupg/blob/6cd241007f390a4be8f18982783e79e7cfb42c5f/NEWS#L1

@puck puck changed the base branch from stable to 5.0-trunk March 20, 2026 10:53
GnuPG 2.4.9 fixes possible memory corruption in armor parsing[0] it appears
that this has also changed the warnings emitted. This test now fails:

  t/seecurity/CVE-2012-4735-incoming-encryption-header.t .. # GnuPG --homedir /tmp/xqR91djkdB
  ok 1 - created a ticket
  ok 2 - loaded ticket
  ok 3 - Found the right attachment
  ok 4 - Incoming encryption header is removed
  ok 5 - Incoming signature header is removed
  ok 6 - created a ticket
  ok 7 - GnuPG warning
  ok 8 - GnuPG warning
  not ok 9 - GnuPG warning

  #   Failed test 'GnuPG warning'
  #   at t/security/CVE-2012-4735-incoming-encryption-header.t line 65.
  #                   'Failure during GnuPG gpg-exit: Failed to gpg-exit
  # '
  #     doesn't match '(?^:Failure during GnuPG data: No data has been found\. The reason is 'No armored data')'
  ok 10 - loaded ticket
  ok 11 - Found the right attachment
  ok 12 - Incoming encryption header is removed
  ok 13 - Incoming signature header is removed
  ok 14 - no warnings
  1..14

These are the warnings emitted:

  $VAR1 = [
            'gpg: keybox \'/tmp/rRZPP1xcq3/pubring.kbx\' created
  gpg: invalid radix64 character 5F skipped
  gpg: invalid radix64 character 5F skipped
  gpg: invalid radix64 character 2E skipped
  gpg: [don\'t know]: invalid packet (ctb=4e)
  ',
            'Failure during GnuPG data: No data has been found. The reason is \'Invalid packet found\'
  ',
            'Failure during GnuPG gpg-exit: Failed to gpg-exit
  '
          ];

Let's only look for the 'No armored data' on < 2.4.9.

Reported in Debian as part of our regular QA processes:
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130943

[0] https://github.com/gpg/gnupg/blob/6cd241007f390a4be8f18982783e79e7cfb42c5f/NEWS#L1
@puck puck force-pushed the fix-gnupg-2.4.9 branch from 1f28145 to 41206d1 Compare March 20, 2026 11:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant