Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: gnupg2@packages.debian.org, Salvatore Bonaccorso <carnil@debian.org>, Andreas Metzler <ametzler@debian.org>
Control: affects -1 + src:gnupg2
User: release.debian.org@packages.debian.org
Usertags: pu

Hello,

I would like to fox the non-DSA CVE-2026-57062 for trixie:
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through
2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is
supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related
to CVE-2026-34182.

This was fixed for sid/forky in 2.4.9-5. The respective patch applies
unchanged to the trixie version.

Since gnupg2 builds a udeb I suspect I might be too late for the next
point release.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

cu Andreas

Hi,

d-i ack needed for the udeb but as far as I'm concerned please go ahead.

Thanks,

I would like to amend this and add the fix for CVE-2026-24882, too.

cu Andreas

Hi Andreas,

*I guess* your followup question was missed as the previous variant
was already acked for upload. We are late now for 13.7 though, so
maybe both changes can be included for 13.8?

Regards,
Salvatore

[...]

Another revision, adding the fix for CVE-2026-105712.

cu Andreas