Maniphest T7905

Radix64 Line-Truncation Enabling Polyglot Attacks
Closed, ResolvedPublic
Actions

Assigned To
• werner
Authored By
• gniibe
Nov 4 2025, 6:50 AM
Tags
Subscribers
• gniibe
• werner

Description

An attacker can craft ASCII-armored OpenPGP data that contains an over-long radix64 line. It will be interpreted differently by GnuPG than by spec-conforming parsers. This enables format-confusion / polyglot attacks.

Related Objects
Search...

Event Timeline

• gniibe created this task.Nov 4 2025, 6:50 AM
• gniibe created this object in space Restricted Space.
• gniibe created this object with visibility "g10code (Project)".
• gniibe created this object with edit policy "g10code (Project)".
• gniibe mentioned this in Unknown Object (Maniphest Task).Nov 10 2025, 2:51 AM
• gniibe updated the task description. (Show Details)Nov 11 2025, 6:59 AM

For someone who considers the rejection is the requirement of the spec., here is a change:

compat-ignore-truncated-line.patch2 KBDownload

• werner closed this task as Resolved.Nov 11 2025, 9:53 AM
• werner claimed this task.
• werner triaged this task as Low priority.
• werner added a subscriber: • werner.

We have seen wrong encodings quite often in the past and thus we won't apply the patch. After all the armor header is a different layer and could also be applied or removed by other software or tools. The integrity of an OpenPGP message does not depend on its concrete outer encoding.

• werner shifted this object from the Restricted Space space to the S1 Public space.Dec 26 2025, 2:59 PM
• werner changed the visibility from "g10code (Project)" to "Public (No Login Required)".
• werner changed the edit policy from "g10code (Project)" to "Contributor (Project)".