Package: devscripts
Version: 2.18.6
Tags: security
who-uploads does this:
GNUPGHOME=$(mktemp -d)
trap '[ ! -d "$GNUPGHOME" ] || rm -r "$GNUPGHOME"' HUP INT QUIT PIPE ALRM
TERM
So when the signal arrives, it removes $GNUPGHOME, and then... it
doesn't exit, but continues checking signatures. This gives local
attacker opportunity to create their own malicious $GNUPGHOME, which gpg
would happily use.
-- System Information:
Architecture: i386
Versions of packages devscripts depends on:
ii dpkg-dev 1.19.2
ii libfile-homedir-perl 1.004-1
ii sensible-utils 0.0.12
ii perl 5.26.2-7+b1
ii python3 3.6.7-1
ii libc6 2.27-6
--
Jakub Wilk
