Re:Decades-old GnuPG bug allowed hackers to spoof just about...
by jerf on Friday June 15, 2018 @01:50PM
(#17321897)
It's difficult to be precise, but I'd bid it out as a minimum of 6 orders of magnitude less, and if someone wanted to bid out 8 or 9 I wouldn't fight them.
It's not a zero-impact issue, but there's so many differences between this and Heartbleed that it just can't be that large. For one thing, there's several orders of magnitude fewer users of GPG than SSL. Then you need a vulnerable configuration. Then you need to have been exploited. Those three things multiply out to quite a few orders of magnitude.
It's not a zero-impact issue, but there's so many differences between this and Heartbleed that it just can't be that large. For one thing, there's several orders of magnitude fewer users of GPG than SSL. Then you need a vulnerable configuration. Then you need to have been exploited. Those three things multiply out to quite a few orders of magnitude.