GPGee version 1.1.2 - Important Security Update

Version 1.1.2 of GPGee has been released.  This release fixes a newly
identified security issue.

In previous versions of GPGee, the mechanism that was intended to
overwrite passphrases after they were used had a flaw that prevented
this from occuring.  This makes is more likely (though still not very)
that a passphrase could end up being written in the clear to the Windows
swap file.

In addition to fixing the above issue, version 1.1.2 has much more
robust internal handling of passphrases all around.  All memory used for
passphrase handling is now locked to prevent it being swapped out.
Also, a better caching mechanism is in place to cache all passphrases
entered during a single verify/decrypt operation.  You never have to
enter a passphrase for a particular key more than once when multiple
files are verified/decrypted in a single operation.  For security
reasons, passphrases are still not ever cached longer than a single
operation.

For those of you who are unfamilliar with the program, GPGee is the
GnuPG Explorer Extension - a Windows shell extension front end for GnuPG
that gives you access to GnuPG functionality directly through the
Windows explorer right-click context menu.

More information (including a full discussion of the new version, the
security flaw, and its implications) and downloads are available from:
http://gpgee.excelcia.org

	Kurt Fitzner

_______________________________________________
Gnupg-announce mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-announce

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iQEVAwUBQuqtxN366Kf2Ie2tAQPJ8ggAkKWzgvLfKjqpts8L8el5IeSd56pthmA5
Egi8u6QUCSPlDmPlNzIcEWrZZy8vPkjyH+8tp8PPBi8OYRIb6GvPFKaSj98LOLu6
yUD2/04CCfWp0KHaik9+tcfJjwZ5TpKO30MHBBDIi7Unj+qvOf0U+CPB7k6wIaHM
y1GfAtt6A8YhzCzJGNuBhGk6Ry1+1OhhQjiI3LwxPD0CwRkQ+7yftqroHHldVaHP
saNAQaNJV9IAb+4HOTnsN7z/plbVpvV4l/tW2tT6XNH0aGf7L/t4/56TlN/iDTnV
U+lW4kMQ2VWd5UKnv1AGt0k+FzQnH7+XCqXuZvAa6h9vr27yjyunZw==
=MHZ8
-----END PGP SIGNATURE-----