En resumen
- CVE-2024-25711 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a diffoscope, diffoscope (reproducible builds).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.98%, mayor que el 62.4% de las vulnerabilidades.
- Solución: actualizar a 256 o posterior.
Description
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
NVD description
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free