[tlug] Gnupg serious security bug.

[Edward Middleton <edward@example.com>]

It must be the week for security blunder discoveries.  GnuPG has one as
follows[1]

    Signature verification of non-detached signatures may give a positive
    result but when extracting the signed data, this data may be prepended
    or appended with extra data not covered by the signature. Thus it is
    possible for an attacker to take any signed message and inject extra
    arbitrary data.

It is fixed in version version 1.4.2.2.

Edward

1. http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html