CVE-2020-24972

ÉLEVÉE 8.8CVE-2020-24972 · Published 29/08/2020 · updated 17/06/2026

En bref

CVE-2020-24972 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant kleopatra (kleopatra project), backports sle (opensuse).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.9%, plus élevée que 92.0% des vulnérabilités.
Correctif : mettre à jour vers 20.07.80 ou plus récent.

Package	Affected versions	Patched versions
kleopatra kleopatra_project	`< 20.07.80`	`20.07.80`
backports sle opensuse	`= 15.0`	No fix yet

Description

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

References

lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html · Broken Link
dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b · Patch
dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7
security.gentoo.org/glsa/202008-21 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free