Medium: gnupg2

Issue Overview:

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Affected Packages:

gnupg2

Issue Correction:
Run yum update gnupg2 to update your system.

New Packages:

i686:  
    gnupg2-debuginfo-2.0.22-1.24.amzn1.i686  
    gnupg2-smime-2.0.22-1.24.amzn1.i686  
    gnupg2-2.0.22-1.24.amzn1.i686  
  
src:  
    gnupg2-2.0.22-1.24.amzn1.src  
  
x86_64:  
    gnupg2-2.0.22-1.24.amzn1.x86_64  
    gnupg2-smime-2.0.22-1.24.amzn1.x86_64  
    gnupg2-debuginfo-2.0.22-1.24.amzn1.x86_64  

Additional References

Red Hat: CVE-2013-4351, CVE-2013-4402

Mitre: CVE-2013-4351, CVE-2013-4402