What’s Vulnerable › Vulnerabilities

CVE-2024-25711

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-27 · updated 2026-06-17
• Weakness: CWE-22

Description

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

Affected products

• Fedoraproject Fedora: 39
• Reproducible Builds Diffoscope: before 256 — fixed in 256

How to fix

Upgrade to a fixed version: Reproducible Builds Diffoscope 256. Check the vendor advisory for mitigations.

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/
• https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e
• https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/
• https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e
• https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361

Get alerted when CVE-2024-25711 or the next vulnerability affects your stack