What’s Vulnerable › Vulnerabilities

CVE-2020-24972

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-08-29 · updated 2026-06-17
• Weakness: CWE-116

Description

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Affected products

• Fedoraproject Fedora: 32
• Kleopatra Project Kleopatra: before 20.07.80 — fixed in 20.07.80
• openSUSE Backports Sle: 15.0-sp1
• openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: Kleopatra Project Kleopatra 20.07.80. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html
• https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
• https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7/
• https://security.gentoo.org/glsa/202008-21
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html
• https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
• https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7/
• https://security.gentoo.org/glsa/202008-21

Get alerted when CVE-2020-24972 or the next vulnerability affects your stack