Tickets :: Comment on [#9493] GPG encryption chooses wrong key.

* Your Email Address
* Spam protection	Enter the letters below: \ /.__ __ ..__. >< [__)/ ` \|\| \| / \\| \\__.\__\|\|__\|
Comment	> If user o@bar.com writes an encrypted email to foo@bar.com imp uses > the publickey of o@bar.com instead of foo@bar.com. > > I suspect (but did not yet try this) that this would happen also if > user someone@bar.com writes an email to o@bar.com but has the key of > foo@bar.com in his keyring and this key is above the key of > o@bar.com. As this is a potential security issue, i marked this bug > as high. > > most probably you do not escape the email address properly before > searching the key. in gpg the default lookup strategy is string > match. if you want to lookup an emailadress, you should use > <foo@bar.com>
Attachment
Watch this ticket