A warning to users of GPG (aka GNUPG)

[M K Saravanan <mksarav@xxxxxxxxxxxxxxxxx>]

-- mks --


---------- Forwarded message ----------
Date: Fri, 10 Nov 2000 16:54:48 -0800
From: Greg Black <gjb@xxxxxxxx>
Reply-To: FreeDevelopers@xxxxxxxxxx
To: FreeDevelopers@xxxxxxxxxx
Subject: A warning to users of GPG (aka GNUPG)

Those of you who use GPG for personal encryption software should
be aware of a security problem with versions prior to 1.04 as
disclosed in the following announcement:

    Versions of gnupg prior to 1.04 fail to correctly verify
    multiple signatures contained in a single document. Only the
    first signature encountered is actually verified, meaning
    that other data with invalid signatures (e.g. data which has
    been tampered with by an attacker) will not be verified, and
    the entire document will be treated as having valid
    signatures.

If you are using an older version, it would be very wise to
update now.

Greg