CVE catalog

CVE-2024-25711

diffoscope: CVE-2024-25711

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.99% · Oct 25, 2026

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandiffoscopesid335fixed
Debiandiffoscopeforky334fixed
Debiandiffoscopetrixie297+deb13u1fixed
Debiandiffoscopebookworm240+deb12u1vulnerable
Opensusediffoscopetumbleweed261-1.1fixed
Ubuntudiffoscope16.0433vulnerable
Ubuntudiffoscope16.0438vulnerable
Ubuntudiffoscope16.0441vulnerable
Ubuntudiffoscope16.0442vulnerable
Ubuntudiffoscope16.0448vulnerable
Ubuntudiffoscope16.0449vulnerable
Ubuntudiffoscope16.0451vulnerable
Ubuntudiffoscope18.0487vulnerable
Ubuntudiffoscope18.0488vulnerable
Ubuntudiffoscope18.0490build1vulnerable
Ubuntudiffoscope18.0491build1vulnerable
Ubuntudiffoscope18.0491ubuntu1vulnerable
Ubuntudiffoscope18.0492ubuntu1vulnerable
Ubuntudiffoscope18.0493ubuntu1vulnerable
Ubuntudiffoscope20.04125vulnerable
Ubuntudiffoscope20.04131vulnerable
Ubuntudiffoscope20.04132vulnerable
Ubuntudiffoscope20.04133vulnerable
Ubuntudiffoscope20.04134vulnerable
Ubuntudiffoscope20.04135vulnerable
Ubuntudiffoscope20.04136vulnerable
Ubuntudiffoscope20.04137vulnerable
Ubuntudiffoscope22.04180vulnerable
Ubuntudiffoscope22.04194buildvulnerable
Ubuntudiffoscope22.04195vulnerable
Ubuntudiffoscope22.04200vulnerable
Ubuntudiffoscope22.04201vulnerable
Ubuntudiffoscope22.04202vulnerable
Ubuntudiffoscope22.04203vulnerable
Ubuntudiffoscope22.04204vulnerable
Ubuntudiffoscope22.04205vulnerable
Ubuntudiffoscope24.04249vulnerable
Ubuntudiffoscope24.04251vulnerable
Ubuntudiffoscope24.04253vulnerable
Ubuntudiffoscope24.04254vulnerable
Ubuntudiffoscope24.04255vulnerable
Ubuntudiffoscope24.04257vulnerable
Ubuntudiffoscope24.04258vulnerable
Ubuntudiffoscope24.04259vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandiffoscopesourcesid256not yet assignedNot reportedNot reported
Debiandiffoscopesourceforky256not yet assignedNot reportedNot reported
Debiandiffoscopesourcetrixie256not yet assignedNot reportedNot reported
Debiandiffoscopesourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensusediffoscoperpmtumbleweed261-1.1Not reportedOPENSUSE-SU-2024:13792-1Not reported

Notes

[bookworm] diffoscope: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]