gpg.fail

"in the hurry of leaving i forgot the sites src at home, sorry, had to rewrite the whole thing. expect a nicer site by tomorrow. im patching as we speak."
- reaper (<- to blame)

1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG
2. GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field
3. Cleartext Signature Plaintext Truncated for Hash Calculation
4. Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks
5. Memory Corruption in ASCII-Armor Parsing
6. Trusted comment injection (minisign)
7. Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG
8. OpenPGP Cleartext Signature Framework Susceptible to Format Confusion
9. GnuPG Output Fails To Distinguish Signature Verification Success From Message Content
10. Cleartext Signature Forgery in GnuPG
11. Radix64 Line-Truncation Enabling Polyglot Attacks
12. GnuPG may downgrade digest algorithm to SHA1 during key signature checking
13. GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys
14. Trusted comment Injection (minisign)

Video https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i/oembed