Summary
The remote host is missing an update to gnupg
announced via advisory DSA 429-2.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20429-2
Insight
Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing.
The update provided in DSA 459-1 disables the use of this type of key, using an interim fix. This update, DSA 459-2, implements a more correct and permanent fix provided by David Shaw.
For the current stable distribution (woody) this problem has been fixed in version 1.0.6-4woody3.
We recommend that you update your gnupg package.
Severity
Classification
-
CVE CVE-2003-0971 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities