CVE-2025-8454

{"id": "CVE-2025-8454", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-01T06:15:29.493", "references": [{"url": "https://bugs.debian.org/1109251", "tags": ["Issue Tracking", "Mailing List"], "source": "security@debian.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then."}, {"lang": "es", "value": "Se descubri\u00f3 que uscan, una herramienta para escanear o vigilar fuentes originales en busca de nuevas versiones de software, incluida en devscripts (una colecci\u00f3n de scripts para facilitar la vida del mantenedor de paquetes Debian), omite la verificaci\u00f3n OpenPGP para archivos ya descargados incluso si una verificaci\u00f3n previa fall\u00f3."}], "lastModified": "2025-08-06T16:17:38.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:debian:devscripts:2.25.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03D0F848-1E33-47BF-8523-03792C46EC92"}], "operator": "OR"}]}], "sourceIdentifier": "security@debian.org"}