CVE-2024-25711

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file

High · published February 11, 2024

CVSS v3.1
7.1
EPSS
1%
Percentile
62.1
In the wild
Unconfirmed
What it is

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00987 · 62.1th percentile
Published
2024-02-11T00:00Z
EPSS history
Timeline
  • 11 FEB 00:00Z
    diffoscope before 256 allows directory traversal via an embedded filename in a GPG file
    cvelistv5