SigSpoof () is a family of
security vulnerabilities that affected the software package
GNU Privacy Guard
GNU Privacy Guard (GnuPG or GPG) is a free-software replacement for Symantec's cryptographic software suite PGP. The software is compliant with the now obsoleted , the IETF standards-track specification of OpenPGP. Modern versions of PGP are ...
("GnuPG") since version 0.2.2, that was released in 1998.
Several other software packages that make use of GnuPG were also affected, such as
Pass and
Enigmail.
In un-
patched versions of affected software, SigSpoof attacks allow
cryptographic signatures to be convincingly
spoofed, under certain circumstances.
This potentially enables a wide range of subsidiary attacks to succeed.
References
Vulnerability
Computer security exploits
{{computer-security-stub