Cyber ·
USN-9087-1: command execution via gpg-key2ps in the signing-party package
Ubuntu Security advisory dated 12/11/2026 on gpg-key2ps from signing-party, which does not properly sanitize user IDs before passing them to a shell and may allow command execution when processing a malicious OpenPGP key.
Advisory USN-9087-1, published in the Ubuntu Security feed on November 12, 2026, describes a flaw in the gpg-key2ps tool, part of the signing-party package. According to the text received, the tool does not properly sanitize user IDs before passing them to a shell. If a user is tricked into processing a specially crafted OpenPGP key, an attacker could possibly exploit the issue to run arbitrary commands.
The text received does not state affected or fixed versions. To check them, consult the original Ubuntu Security advisory using the identifier USN-9087-1 and confirm in your package manager which versions are installed in your environment.
The relevance to Rota Nacional is indirect. The platform does not patch or monitor third-party tools installed on the organization's servers. If your team uses signing-party, the practical action is to apply the distribution's security update and avoid processing keys from untrusted sources.
Original source: USN-9087-1: vulnerabilidade no signing-party