[USN-3733-1] GnuPG vulnerability

[Alex Murray]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

==========================================================================
Ubuntu Security Notice USN-3733-1
August 07, 2018

gnupg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS

Summary:

GnuPG could be made to expose sensitive information.

Software Description:
- - gnupg: GNU privacy guard - a free PGP replacement

Details:

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink,
Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom
discovered that GnuPG is vulnerable to a cache side-channel attack. A local
attacker could use this attack to recover RSA private keys.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  gnupg                           1.4.20-1ubuntu3.3
  gnupg-curl                      1.4.20-1ubuntu3.3
  gpgv                            1.4.20-1ubuntu3.3

Ubuntu 14.04 LTS:
  gnupg                           1.4.16-1ubuntu2.6
  gnupg-curl                      1.4.16-1ubuntu2.6
  gpgv                            1.4.16-1ubuntu2.6

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/usn/usn-3733-1
  CVE-2017-7526, https://launchpad.net/bugs/1785176

Package Information:
  https://launchpad.net/ubuntu/+source/gnupg/1.4.20-1ubuntu3.3
  https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.6

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEiOlTC8vdwgBRe16w9JjS2d59rZwFAltpWFIACgkQ9JjS2d59
rZyPrQf/VPt2TDffx0VcATRASWbufWwfCoLqi1WctpRX4AEACWX1Y9yv3BVhql/X
KFMfULBhtNh5D41o7H1SHUhQPdxSYStt/0meXeU90ufgmdw5xacNTTUvQtDbMp+P
OZj7dm/zer8WYbgqHGWWLcuu6gL5TQ+6Bqlxn6VnfZunUXSEL+EXWOQgSflgBae0
78pixw2AfBy82kB+PFcG8JkX9P4JGSjE3iJhXOer6RbiAAIhQ4VAM8NXHvENK3Ru
aHzu/NrEAHIlZGwYiwOCl7gFZn2X+BWJAVBEzNUSqu+p4+ZhZON127dtIo0Ni62J
wZltX5i0XZQrHOxzukbimZsiv+aM/g==
=X0Hg
-----END PGP SIGNATURE-----