Detailed proof of concepts can be found in the following blog posts:

### 5.2 GPG API Attack Class

* Status Line Injection through Embedded Filename (G1): [SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTools and python-gnupg (CVE-2018-12020)](https://neopg.io/blog/gpg-signature-spoof)
* State Confusion and Regular Expressions in Enigmail (G2): [SigSpoof 2: More ways to spoof signatures in GnuPG (CVE-2018-12019)](https://neopg.io/blog/enigmail-signature-spoof)

### 7. Additional Findings

#### 7.3. OpenPGP Message Composition Attacks

* Encryption Spoofing: [Not everything that looks encrypted, is encrypted](https://neopg.io/blog/encryption-spoof)

#### 7.5 GPG API Attacks Beyond Email

* Signature Bypass in Simple Password Store: [SigSpoof 3: Breaking signature verification in pass (Simple Password Store) (CVE-2018-12356)](https://neopg.io/blog/pass-signature-spoof/)
* Yarn Package Manager: [SigSpoof 4: Bypassing signature verification in Yarn package manager (CVE-2018-12556)](https://neopg.io/blog/yarn-signature-bypass/)
