Executive Summary

This vulnerability in GnuPG through version 2.4.8 involves a flaw where if a signed message contains a form feed character (\f) at the end of a plaintext line, an attacker can create a modified message that appends additional text after the signed content. Despite this modification, the signature verification process incorrectly succeeds, although it prints an "invalid armor" warning during verification. This happens because \f is used as a marker to indicate truncation of a long plaintext line.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to alter a signed message by appending extra content after the originally signed material without causing the signature verification to fail. This means the integrity of signed messages can be compromised, potentially leading to acceptance of tampered messages as authentic, which can undermine trust and security in communications.

Useful 0 Not Useful 0