[pkg-gnupg-maint] Bug#1141483: trixie-pu: package gnupg2/2.4.7-21+deb13u2

[Andreas Metzler]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: gnupg2 at packages.debian.org, Salvatore Bonaccorso <carnil at debian.org>, Andreas Metzler <ametzler at debian.org>
Control: affects -1 + src:gnupg2
User: release.debian.org at packages.debian.org
Usertags: pu

Hello,

I would like to fox the non-DSA CVE-2026-57062 for trixie:
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through
2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is
supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related
to CVE-2026-34182.

This was fixed for sid/forky in 2.4.9-5. The respective patch applies
unchanged to the trixie version.

Since gnupg2 builds a udeb I suspect I might be too late for the next
point release.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 2.4.7-21+deb13u2.deb.diff
Type: text/x-diff
Size: 3685 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/attachments/20260705/c728ced5/attachment.diff>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/attachments/20260705/c728ced5/attachment.sig>