signing-party vulnerability allows arbitrary command execution via gpg-key2ps

A security vulnerability has been identified in the signing-party suite, specifically within the gpg-key2ps utility. The flaw stems from improper sanitization of user IDs before they are passed to a shell environment.

An attacker can exploit this by tricking a user into processing a maliciously crafted OpenPGP key. If successful, the vulnerability allows for arbitrary command execution with the privileges of the user running the tool. Fixes are currently being provided via Ubuntu Pro ESM for older LTS releases.

Technical breakdown of CVE-2019-11627

• Defect Class: Command injection via improper input sanitization.
• Affected Component: The gpg-key2ps tool within the signing-party package suite.
• Attack Vector: Local execution triggered by processing a specially crafted OpenPGP key containing malicious user IDs.
• Vulnerability Mechanism: The tool fails to sanitize user ID strings before passing them directly to a shell, enabling shell metacharacters to execute unintended commands.
• Mitigation: Users on Ubuntu 18.04 LTS and 16.04 LTS must update to signing-party versions 2.7-1ubuntu0.1~esm1 and 2.2-1ubuntu0.1~esm1 respectively via Ubuntu Pro ESM.

Why it matters

This vulnerability highlights the risks associated with shell-based processing of untrusted cryptographic metadata. For users on legacy Ubuntu LTS systems, the fix requires an active Ubuntu Pro subscription to access the ESM (Extended Security Maintenance) updates for the Universe repository.