Signing-Party Vulnerability — Ubuntu Security Update (USN-9087-1)
USN-9087-1 updates Ubuntu 20.04, Ubuntu 22.04: It was discovered that the gpg-key2ps tool in signing-party did not properly sanitize user IDs before passing them to a shell. Apply the update via standard apt tooling.
Was das unter einer SharedLicense-Lizenz bedeutet
The advisory's own severity data peaks at CVSS ; unpatched Ubuntu 20.04, Ubuntu 22.04 servers remain exposed until updated.
-
USN-9087-1
Publication date
12 November 2026
Overview
signing-party could be made to run programs as your login if it processed a
specially crafted OpenPGP key.
Releases
Packages
- signing-party – Various OpenPGP related tools
Details
It was discovered that the gpg-key2ps tool in signing-party did not
properly sanitize user IDs before passing them to a shell. If a user were
tricked into processing a specially crafted OpenPGP key, an attacker could
possibly use this issue to execute arbitrary commands.
It was discovered that the gpg-key2ps tool in signing-party did not
properly sanitize user IDs before passing them to a shell. If a user were
tricked into processing a specially crafted OpenPGP key, an attacker could
possibly use this issue to execute arbitrary commands.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | signing-party – 2.7-1ubuntu0.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | ||
| 16.04 LTS xenial | signing-party – 2.2-1ubuntu0.1~esm1 | ||
References
Häufig gestellte Fragen
What does USN-9087-1 fix?
Which Ubuntu releases are covered?
How do I apply it?
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen