librnp uses weak random number generation such that generated keys can be easily cracked.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-util/librnp | * | = 0.18.0 | >= 0.18.1, < 0.18 |
librnp is a high performance C++ OpenPGP library.
The affected librnp version generated weak session keys for its public key encryption (PKESK) mode.
Messages encrypted using the affected librnp version might be readable by an attacker with just the public key.
There is no known workaround at this time.
All librnp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/librnp-0.18.1"
If sensitive information was sent using e.g. Thunderbird (with USE=system-librnp, the default), it should be considered potentially viewable by an attacker.