CVE-2024-25711

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25711
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ Mailing List
https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e Patch
https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ Mailing List
https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e Patch
https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

28 May 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-22
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - Mailing List
References () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - Patch
References () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - Vendor Advisory
CPE cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Fedoraproject
Reproducible Builds
Reproducible Builds diffoscope

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/ -
References () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e - () https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e -
References () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 - () https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 -

27 Feb 2024, 14:20

Type Values Removed Values Added
Summary
  • (es) diffoscope anterior a 256 permite el directory traversal a través de un nombre de archivo incrustado en un archivo GPG. El contenido de cualquier archivo, como ../.ssh/id_rsa, puede revelarse a un atacante. Esto ocurre porque el valor de la opción gpg --use-embedded-filenames es confiable.

27 Feb 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 02:15

Updated : 2025-05-28 16:15

NVD link : CVE-2024-25711

Mitre link : CVE-2024-25711

CVE.ORG link : CVE-2024-25711

JSON object : View

Products Affected

reproducible_builds

  • diffoscope

fedoraproject

  • fedora
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')