Your message dated Sat, 10 Oct 2026 14:34:55 +0000
with message-id <[email protected]>
and subject line Bug#1150168: fixed in gnupg2 2.4.9-8
has caused the Debian Bug report #1150168,
regarding gnupg2: CVE-2026-105712
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150168: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150168
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gnupg2
Version: 2.4.9-7
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for gnupg2.
CVE-2026-105712[0]:
| gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted
| data in an archive. When extracting an untrusted archive with
| --directory (aka -C) into an existing directory containing a pre-
| existing symlink, gpgtar can follow that symlink and create or
| overwrite a file outside the selected extraction directory. The
| write is limited by the extraction user's filesystem permissions. An
| archive extracted into a fresh empty directory does not have this
| risk.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-105712
https://www.cve.org/CVERecord?id=CVE-2026-105712
[1] https://static.dev.gnupg.org/T8159.html
[2] https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html
[3] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: gnupg2
Source-Version: 2.4.9-8
Done: Andreas Metzler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
gnupg2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Metzler <[email protected]> (supplier of updated gnupg2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 10 Oct 2026 15:36:45 +0200
Source: gnupg2
Architecture: source
Version: 2.4.9-8
Distribution: unstable
Urgency: medium
Maintainer: Debian GnuPG Maintainers <[email protected]>
Changed-By: Andreas Metzler <[email protected]>
Closes: 1150168
Changes:
gnupg2 (2.4.9-8) unstable; urgency=medium
.
* Add upstream patchset for CVE-2026-105712
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data
in an archive. When extracting an untrusted archive with --directory
(aka -C) into an existing directory containing a pre-existing symlink,
gpgtar can follow that symlink and create or overwrite a file outside
the selected extraction directory. The write is limited by the
extraction user's filesystem permissions. An archive extracted into a
fresh empty directory does not have this risk.
https://static.dev.gnupg.org/T8159.html (Closes: #1150168)
Checksums-Sha1:
eca456f7321804f6d7f9d5bd6b69d7528d268111 5459 gnupg2_2.4.9-8.dsc
f9b45ee04e1e8ad20c82f4b1f249592440050c3b 110392 gnupg2_2.4.9-8.debian.tar.xz
Checksums-Sha256:
aa955788f65d6f476642be6ee0c77084a093c0d6533fabb46afdb39c549a7219 5459
gnupg2_2.4.9-8.dsc
69e954dc52f1a674bf567aa40064e24ca230210394975a6cddf98742e2a6f882 110392
gnupg2_2.4.9-8.debian.tar.xz
Files:
4bef3973b08bb8eda8ba615cf64bf067 5459 utils optional gnupg2_2.4.9-8.dsc
a233452166751126c7bbe2662b5f698d 110392 utils optional
gnupg2_2.4.9-8.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmrKQhQACgkQpU8BhUOC
FITR6RAAiXb6g8L2Dg7seL/SbJnU/U/tuQKW60g6OOlEpZ4ugZeQvf3QOkUN+Vw1
rYJdIjfH38V0M+YHY03LHC3ouo5Fi86BEUqUjtswImeWNmg7Fjtyv7l7dWUuBdIF
QdCqXoPw5MAtwyvjULFNCu5Ohtar7RdCmL1j6wP1w9tJk/o/82vPoFhPSPX1O6OM
9oy1g8KTmlNbPk0VAGziku5nADFk/uAmUNAwnHKiCAuVN4EyKLiH7FBN1iUCFfbH
E7SLTGOkZz3YDEe99IVlsq+urmpvFxdT38aAsp6PZBRZ1pGQ72lrEV6EtmJm/dD2
t1WnVKSK5TpOpoop6HwMkAMo9uocqioYFyaFNk0XFruydledohqUbnTiVpVNtf2g
93HTYK5RsiF1mANgOMUu+Ofd+yvzgk83bFkDkUaQdcZk28HNu/6FeNwBZqCUQWF0
YGS4hJZ1SS+3FjkqP86DEBOvATi32NMOMXoYn1X97QjBzryUmp1dAGgdyNKxdOia
9NEZGq3PurhRvB5pNl/msJVeMooh9I+TQllzPxFbb9jywzdxZlx6R4i7LqwT8QeC
w5MkEWlPWTfjKLaI95NOtVWZ8k2utGE1SEfLDl1Jcs27YFyh8YQpisl8AfBE8+pB
GuDVaLFgI5DV1RiipDXtRMtEgu9T55rAXKvvuoUkBqW0U+jMu6g=
=NcXc
-----END PGP SIGNATURE-----
pgpuBiE2UEKqp.pgp
Description: PGP signature
--- End Message ---
