BLOG
At a glance
- Ubuntu has issued a fix for CVE-2019-11627 in signing-party.
- When processing a specially crafted OpenPGP key, gpg-key2ps may execute arbitrary commands with the logged-in account's privileges.
- The advisory lists signing-party packages for Ubuntu Bionic and Xenial in their respective ESM pockets.
- Check the package version and Ubuntu Pro/ESM status, then update to the corresponding fixed version.
Ubuntu patches command-execution vulnerability in signing-party on Bionic and Xenial
Ubuntu has issued a fix for CVE-2019-11627 in signing-party: gpg-key2ps may execute commands as the logged-in user when processing a specially crafted OpenPGP key. Prioritize updates on Ubuntu Bionic and Xenial, and confirm access to the relevant Ubuntu Pro/ESM service.
In this article
Ubuntu has published an advisory for a vulnerability in signing-party, a toolset related to OpenPGP key handling. Ubuntu Bionic and Xenial administrators should check the package version and access to the relevant ESM pocket.
Overview and technical details
CVE-2019-11627 affects gpg-key2ps in signing-party. The advisory describes a risk of arbitrary command execution with the logged-in account's privileges if a user is tricked into processing a specially crafted OpenPGP key.
| Field | Details |
|---|---|
| Product | signing-party, including the gpg-key2ps tool |
| CVE | CVE-2019-11627 |
| Source | Ubuntu USN |
Affected systems
The advisory lists signing-party packages for Ubuntu Bionic and Xenial, with corresponding fixed versions released in ESM pockets. Compare the installed version with the version for the specific Ubuntu release.
| Release | Package and pocket | Fixed version |
|---|---|---|
| Ubuntu Bionic | signing-party, esm-apps | 2.7-1ubuntu0.1~esm1 |
| Ubuntu Xenial | signing-party, esm-apps-legacy | 2.2-1ubuntu0.1~esm1 |
Mechanism and impact
gpg-key2ps does not properly sanitize user IDs before passing data to the shell. If a user is tricked into processing a specially crafted OpenPGP key, the tool may execute arbitrary commands with the privileges of the logged-in account.
System checks
Check the installed signing-party version and package policy. If the installed version is lower than the fixed version for the corresponding Ubuntu release, an update is needed.
dpkg-query -W -f='${Version}\n' signing-party apt-cache policy signing-partyCheck Ubuntu Pro/ESM status to confirm that the relevant service is enabled and the system can receive updates from the corresponding pocket.
pro status
Remediation and mitigation
Prioritize updating signing-party on Ubuntu Bionic and Xenial systems using affected packages.
Perform a standard system update and ensure signing-party is upgraded to the fixed version in the corresponding ESM pocket. For packages in an ESM pocket, confirm the system has access to the relevant Ubuntu Pro service.
Source: Ubuntu USN-9087-1.
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel CVE-2026-99284: Local Privilege Escalation to Root and the Required Fix
Zero Day Initiative warns of CVE-2026-99284 in Linux Kernel: a low-privileged user able to execute code locally could escalate to root. Identify running kernel versions and update to a Linux release containing the fix.
Linux Kernel: BPF Local Storage race condition may enable privilege escalation
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.
