diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
References
Configurations
History
28 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 |
04 Mar 2025, 12:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Fedoraproject
Reproducible Builds Fedoraproject fedora Reproducible Builds diffoscope |
|
| CPE | cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:* |
|
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - Mailing List | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - Vendor Advisory | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - Patch |
27 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-27 02:15
Updated : 2025-05-28 16:15
NVD link : CVE-2024-25711
Mitre link : CVE-2024-25711
JSON object : View
Products Affected
reproducible_builds
- diffoscope
fedoraproject
- fedora
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')