CVE-2024-25711

High

Description

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Reproducible Builds Diffoscope

PublishedFeb 27, 2024

First seenFeb 27, 2024

Weakness typeCWE-22Path traversal

How to fix

Update

reproducible_builds diffoscope256 or later
diffoscope256 or later

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/

Affected products

Product	Affected versions	Fixed in
reproducible_builds diffoscope	v < 256	256
fedoraproject fedora	39	—
diffoscopePyPI	v < 256	256

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.