2.4.9-2

(cherry picked from commit f4e60e986b)

0003-gpg-allow-import-of-previously-known-keys-even-witho.patch

@@ -22,7 +22,7 @@ index 2b470ee21..b5a9b43ae 100644
 --- a/g10/import.c
 +++ b/g10/import.c
 @@ -1996,7 +1996,6 @@ import_one_real (ctrl_t ctrl,
-   size_t an;
+   int non_self_or_utk = 0;
    char pkstrbuf[PUBKEY_STRING_SIZE];
    int merge_keys_done = 0;
 -  int any_filter = 0;

gnupg-2.4.9-tpm2daemon.patch

@@ -0,0 +1,62 @@
+From 93fa34d9a346020355cd51d54102d30d4f177323 Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Mon, 26 Jan 2026 11:13:44 +0100
+Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
+
+* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
+(tpm2_rsa_decrypt): Ditto.
+--
+
+GnuPG-bug-id: 8045
+Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
+Reported-by: OpenAI Security Research
+---
+ tpm2d/tpm2.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
+index a4677fb98..282de5e5d 100644
+--- a/tpm2d/tpm2.c
++++ b/tpm2d/tpm2.c
+@@ -951,10 +951,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   size_t len;
+   int ret;
+ 
++#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
++  if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_ECC_KEY_BYTES)    /* IBM stack */
++  if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   /* This isn't really a decryption per se.  The ciphertext actually
+    * contains an EC Point which we must multiply by the private key number.
+    *
+-   * The reason is to generate a diffe helman agreement on a shared
++   * The reason is to generate a diffie-hellman agreement on a shared
+    * point.  This shared point is then used to generate the per
+    * session encryption key.
+    */
+@@ -1010,6 +1020,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   TPM_HANDLE ah;
+   char *auth;
+ 
++#if defined(TPM2_MAX_RSA_KEY_BYTES)  /* Intel stack */
++  if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_RSA_KEY_BYTES)     /* IBM stack */
++  if (ciphertext_len > MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   inScheme.scheme = TPM_ALG_RSAES;
+   /*
+    * apparent gcrypt error: occasionally rsa ciphertext will
+-- 
+2.52.0
+

gnupg2.spec

@@ -2,7 +2,7 @@
 
 Summary: Utility for secure communication and data storage
 Name:    gnupg2
-Version: 2.4.7
+Version: 2.4.9
 Release: 2%{?dist}
 
 License: CC0-1.0 AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later AND (BSD-3-Clause OR LGPL-3.0-or-later OR GPL-2.0-or-later) AND CC-BY-4.0 AND MIT
@@ -20,6 +20,9 @@ Patch2:  gnupg-2.4.7-file-is-digest.patch
 Patch3:  gnupg-2.4.7-fips-algo.patch
 # allow 8192 bit RSA keys in keygen UI with large RSA
 Patch4:  gnupg-2.4.7-large-rsa.patch
+# CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
+# https://dev.gnupg.org/T8045
+Patch5:  gnupg-2.4.9-tpm2daemon.patch
 
 # Patches from FreePG:
 # https://gitlab.com/freepg/gnupg/-/tree/main/STABLE-BRANCH-2-4-freepg
@@ -124,6 +127,7 @@ to the base GnuPG package
 %patch 2 -p1 -b .file-is-digest
 %patch 3 -p1 -b .fips
 %patch 4 -p1 -b .large-rsa
+%patch 5 -p1 -b .tpm2d
 
 %patch 20 -p1 -b .good_revoc
 %patch 21 -p1 -b .prev_known_key
@@ -247,6 +251,18 @@ make -k check
 
 
 %changelog
+* Tue Feb 03 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-2
+- Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
+
+* Thu Jan 01 2026 Clemens Lang <cllang@redhat.com> - 2.4.9-1
+- New upstream release 2.4.9
+- Fixes CVE-2025-68973 (https://gpg.fail/memcpy)
+- Fixes https://gpg.fail/sha1
+- Fixes https://gpg.fail/detached
+
+* Fri May 16 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.8-1
+- New upstream release 2.4.8
+
 * Thu Jan 23 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-2
 - Regenerate patches and pull new from FreePG project
 

sources

@@ -1,2 +1,2 @@
-SHA512 (gnupg-2.4.7.tar.bz2) = 3e84f1679904bf0efb789df6466e468bd2be9149d52561f35e2380038133479bebf1c61ee7adf6d3564b370915f32111098c052be6e6acaf3083a807f9f36019
-SHA512 (gnupg-2.4.7.tar.bz2.sig) = b0ccf9c460605f8a1727b0c4260b0e174d4761a36ca8ab2c04bace5bf7734b4b908e4251f8c226caa1d90bf2061434d1587dc9d1966e5b0c109a3b4a017e6c7d
+SHA512 (gnupg-2.4.9.tar.bz2) = 4638016b390a0024fa0cbe14181c43a81991e4275043855397ef099b927985d175d32452fc15b06485623b9292662dd6da464b2e5def8b77b2e4e48a072ab521
+SHA512 (gnupg-2.4.9.tar.bz2.sig) = 03328ba7de3faab1aab025784ef16cc04dd34d2cc09db2c513b7e38836b8036e04d2bb3c71aa64769b5a40a7a877373ee2d11b6e2bf8b67938216277dcd18a6f