Hello!
We are pleased to announce the availability of a new stable GnuPG-1
release: Version 1.4.17. This release includes a *security fix* to stop
a possible DoS using garbled compressed data packets which can be used
to put gpg into an infinite loop.
The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and
data storage. It is a complete and free replacement of PGP and can be
used to encrypt data and to create digital signatures. It includes an
advanced key management facility, smartcard support and is compliant
with the OpenPGP Internet standard as described by RFC-4880. GnuPG is
distributed under the terms of the GNU General Public License (GPLv3+).
Note that this version is from the GnuPG-1 series and thus smaller than
those from the GnuPG-2 series, easier to build, and also better portable
to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.23) it
comes with no support for S/MIME, Secure Shell, or other tools useful
for desktop environments. Fortunately you may install both versions
alongside on the same system without any conflict.
What's New
==========
* Avoid DoS due to garbled compressed data packets.
* Screen keyserver reponses to avoid import of unwanted keys by rogue
servers.
* Add hash algorithms to the "sig" records of the colon output.
* More specific reason codes for INV_RECP status.
* Fixes for PC/SC access on Apple.
* Minor bug fixes.
Getting the Software
===================
First of all, decide whether you really need GnuPG version 1.4.x - most
users are better off with the modern GnuPG 2.0.x version. Then follow
the instructions found at https://www.gnupg.org/download/ or read on:
GnuPG 1.4.17 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be
found at https://www.gnupg.org/mirrors.html . Note, that GnuPG is not
available at ftp.gnu.org.
On ftp.gnupg.org and on its mirrors you should find the following new
files in the *gnupg* directory:
- The GnuPG source code compressed using BZIP2 and its OpenPGP
signature:
gnupg-1.4.17.tar.bz2 (3563k)
gnupg-1.4.17.tar.bz2.sig
- The GnuPG source code compressed using GZIP and its OpenPGP
signature:
gnupg-1.4.17.tar.gz (4929k)
gnupg-1.4.17.tar.gz.sig
- A patch file to upgrade a 1.4.16 GnuPG source tree. This patch does
not include updates of the language files.
gnupg-1.4.16-1.4.17.diff.bz2 (21k)
Select one of them. To shorten the download time, you probably want to
get the BZIP2 compressed file. Please try another mirror if exceptional
your mirror is not yet up to date.
In the *binary* directory, you should find these files:
- GnuPG compiled for Microsoft Windows and its OpenPGP signature.
This is a command line only version; the source files are the same
as above.
gnupg-w32cli-1.4.17.exe (1574k)
gnupg-w32cli-1.4.17.exe.sig
Note, that this is a minimal installer and unless you are only in need
for the simple the gpg binary, you are better off using the full
featured installer at https://www.gpg4win.org .
Checking the Integrity
=====================
In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:
* If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the
signature of the file gnupg-1.4.17.tar.bz2 you would use this command:
gpg --verify gnupg-1.4.17.tar.bz2.sig
This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and
made by that signing key. Make sure that you have the right key,
either by checking the fingerprint of that key with other sources
or by checking that the key has been signed by a trustworthy other
key. Note, that you can retrieve the signing key using the command
finger wk ,at' g10code.com | gpg --import
or using a keyserver like
gpg --recv-key 4F25E3B6
The distribution key 4F25E3B6 is signed by the well known key
1E42B367. If you get an key expired message, you should retrieve a
fresh copy as the expiration date might have been prolonged.
NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE
INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION!
* If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.17.tar.bz2, you would run the sha1sum command like this:
sha1sum gnupg-1.4.17.tar.bz2
and check that the output matches the first line from the
following list:
830c7f749ad92d6577c521addea5e5d920128d42 gnupg-1.4.17.tar.bz2
d5b3c25901f182ea20c31f09669f44681c3aaa89 gnupg-1.4.17.tar.gz
ff761de4efc3876c57199612c24b677208da7c10 gnupg-1.4.16-1.4.17.diff.bz2
b2f0db9eebf028d27d0a119334e5e357773dd0d6 gnupg-w32cli-1.4.17.exe
Internationalization
===================
GnuPG comes with support for 29 languages. The Chinese (Simple and
Traditional), Czech, Danish, Dutch, French, German, Norwegian, Polish,
Romanian, Russian, Spanish, Swedish, Ukrainian, and Turkish translations
are close to be complete.
Support
======
Please consult the archive of the gnupg-users mailing list before
reporting a bug <https://gnupg.org/documentation/mailing-lists.html>.
We suggest to send bug reports for a new release to this list in favor
of filing a bug at <https://bugs.gnupg.org>. We also have a dedicated
service directory at:
https://www.gnupg.org/service.html
The driving force behind the development of GnuPG is the company of
its principal author, Werner Koch. Maintenance and improvement of
GnuPG and related software takes up most of their resources. To allow
him to continue this work he kindly asks to either purchase a support
contract, engage g10 Code for custom enhancements, or to donate money:
https://gnupg.org/donate/
Thanks
=====
We have to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, donating money,
spreading the word, or answering questions on the mailing lists.
Happy Hacking,
The GnuPG Team
--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 180 bytes
Desc: not available
URL: </pipermail/attachments/20140623/e1276f91/attachment.sig>