What’s Vulnerable › Vulnerabilities

CVE-2022-4563: Freedom of the Press SecureDrop gpg-agent.conf symlink

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-16 · updated 2026-06-17
• Weakness: CWE-59

Description

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is b0526a06f8ca713cce74b63e00d3730618d89691. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215972.

Affected products

• Freedom of the Press SecureDrop: before 2.5.1 — fixed in 2.5.1

How to fix

Upgrade to a fixed version: Freedom of the Press SecureDrop 2.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/freedomofpress/securedrop/commit/b0526a06f8ca713cce74b63e00d3730618d89691
• https://github.com/freedomofpress/securedrop/compare/2.5.0...2.5.1
• https://github.com/freedomofpress/securedrop/pull/6704
• https://securedrop.org/news/2_5_1-security-advisory/
• https://vuldb.com/?id.215972
• https://github.com/freedomofpress/securedrop/commit/b0526a06f8ca713cce74b63e00d3730618d89691
• https://github.com/freedomofpress/securedrop/compare/2.5.0...2.5.1
• https://github.com/freedomofpress/securedrop/pull/6704
• https://securedrop.org/news/2_5_1-security-advisory/
• https://vuldb.com/?id.215972

Get alerted when CVE-2022-4563 or the next vulnerability affects your stack