I like how this vulnerability report gives a reasonable set of actions for mitigations:

For Users

    Remove verbose from gpg.conf, if you have it.
    Do not use gpg --verbose on the command line.
    Upgrade to GnuPG 2.2.8 or GnuPG 1.4.23
    Upgrade to Enigmail 2.0.7
    Upgrade to GPGTools 2018.3

For developers

    Upgrade to python-gnupg 0.4.3
    Call gpg with --no-verbose to disable the attack.
    Use a dedicated pipe for --status-fd, and do not share it with stderr.
    If this is not easy (or even possible) due to the framework or target platform, consider --batch --log-file FILE to redirect the stderr output, where FILE can be /dev/null, too. Thanks to Patrick Brunschwig for this idea!
    Or, the --status-file FILE option could be used to direct the status lines to a temporary file.