FreeBSD: VID-53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec (CVE-2018-12356): password-store -- GPG parsing vulnerabilities

Jason A. Donenfeld reports: Markus Brinkmann discovered that [the] parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username. This has a number of nasty consequences: an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your .gpg-id key and have your passwords encrypted under additional keys; if you have extensions enabled (disabled by default), an attacker who manages to write into your ~/.password-store and also inject a malicious key into your keyring can replace your extensions and hence execute code.