on
March 10th 2006 at 4:21 pm in According to this post on the GPG mailing-list, GPG doesn’t detect the injection of unsigned data. That is rather a serious issue, so upgrading to the latest version is advised:
In the aftermath of the false positive signature verfication bug
(announced 2006-02-15) more thorough testing of the fix has been done
and another vulnerability has been detected.This new problem affects the use of *gpg* for verification of
signatures which are _not_ detached signatures. The problem also
affects verification of signatures embedded in encrypted messages;
i.e. standard use of gpg for mails.
As usual, you can download the latest version from the GPG download page.
You have been warned…
no comments 
