diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
References
Configurations
History
04 Nov 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* |
|
| First Time |
Reproducible Builds
Fedoraproject Reproducible Builds diffoscope Fedoraproject fedora |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-22 | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - Mailing List | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - Patch | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - Vendor Advisory |
21 Nov 2024, 09:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - | |
| References | () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - |
27 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-27 02:15
Updated : 2025-11-04 19:17
NVD link : CVE-2024-25711
Mitre link : CVE-2024-25711
CVE.ORG link : CVE-2024-25711
JSON object : View
Products Affected
fedoraproject
- fedora
reproducible_builds
- diffoscope
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')