It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://bugs.debian.org/1109251 | Issue Tracking Mailing List |
Configurations
History
06 Aug 2025, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugs.debian.org/1109251 - Issue Tracking, Mailing List | |
| CPE | cpe:2.3:a:debian:devscripts:2.25.15:*:*:*:*:*:*:* | |
| First Time |
Debian devscripts
Debian |
01 Aug 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-01 06:15
Updated : 2025-08-06 16:17
NVD link : CVE-2025-8454
Mitre link : CVE-2025-8454
JSON object : View
Products Affected
debian
- devscripts
CWE
No CWE.