CVE-2024-25711 — Vulnetix

CVE-2024-25711 PUBLISHED CVSS 7.5 HIGH

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

EPSS 5.26% · 90.1th percentile

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

5.26%

90.1th percentile

Affected Products

Vendor	Product	Versions
PyPI	diffoscope	0
n/a	n/a	*
reproducible_builds	diffoscope	0
fedoraproject	fedora	39

Timeline

Feb 11, 2024 CVE Published
Feb 11, 2024 EPSS Score
Mar 9, 2024 EPSS Score
May 2, 2024 EPSS Score
May 29, 2024 EPSS Score
Jun 27, 2024 EPSS Score
Jul 24, 2024 EPSS Score
Sep 16, 2024 EPSS Score
Oct 4, 2024 Coalition ESS Score
Oct 13, 2024 EPSS Score
Nov 9, 2024 EPSS Score
Dec 7, 2024 EPSS Score

References

https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 url
https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e url
FEDORA-2024-3383326db4 vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ url
https://nvd.nist.gov/vuln/detail/CVE-2024-25711 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2024-41.yaml url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47 url
https://salsa.debian.org/reproducible-builds/diffoscope url

Open in Interactive Console →