In breve
- CVE-2024-25711 è una vulnerabilità ALTO (CVSS 7.5) che riguarda diffoscope, diffoscope (reproducible builds).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.98%, superiore al 62.4% delle vulnerabilità.
- Correzione: aggiornare a 256 o successiva.
Description
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
NVD description
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free