Every CVE Search/ Get API key

CVE-2020-24972

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to...

8.8 HighPublic exploitFix available

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.85%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
CVE-2020-24972
CVSS 3.1
8.8 HighCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
Updated
2026-11-02
EUVDEUVD-2020-17672 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
EUVD-2020-17672
CVSS 3.1
8.8 HighCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
Updated
2026-11-03
GitHub AdvisoriesGHSA-p3w5-fpg6-wrh9 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to...

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
GHSA-p3w5-fpg6-wrh9
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-116
Updated
2026-11-02
NVD 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
CVE-2020-24972
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-116
Updated
2026-11-02
OSV 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
CVE-2020-24972
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-24972 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
DEBIAN-CVE-2020-24972
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-24972 8.8

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Record
UBUNTU-CVE-2020-24972
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0425 No score

Updated kleopatra packages fix a security vulnerability

The Kleopatra component before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary library. (CVE-2020-24972).

Record
MGASA-2020-0425
Updated
2026-11-02
OSVopenSUSE-SU-2020:1723-1 No score

Security update for kleopatra

This update for kleopatra fixes the following issues:

  • CVE-2020-24972: Add upstream patch to prevent potential arbitrary code execution (boo#1177932):
Record
openSUSE-SU-2020:1723-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1754-1 No score

Security update for kleopatra

This update for kleopatra fixes the following issues:

  • CVE-2020-24972: Add upstream patch to prevent potential arbitrary code execution (boo#1177932):

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:1754-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kleopatra
Debian:12
 before 4:20.08.2-2
4:20.08.2-2
kleopatra
Debian:13
 before 4:20.08.2-2
4:20.08.2-2
kleopatra
Debian:14
 before 4:20.08.2-2
4:20.08.2-2
kleopatra
Mageia:7
 before 19.04.0-1.1.mga7
19.04.0-1.1.mga7
kleopatra
Ubuntu:18.04:LTS
 All versions, plus listed versions
4:17.04.3-0ubuntu14:17.08.3-0ubuntu14:17.12.2-0ubuntu24:17.12.3-0ubuntu1
 None known
kleopatra
Ubuntu:20.04:LTS
 All versions, plus listed versions
4:19.04.3-0ubuntu14:19.04.3-0ubuntu24:19.12.3-0ubuntu1
 None known
kleopatra
Ubuntu:22.04:LTS
 All versions, plus listed versions
4:21.08.1-0ubuntu14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu14:21.12.0-0ubuntu14:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1
 None known
kleopatra
Ubuntu:24.04:LTS
 All versions, plus listed versions
4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu3
 None known
kleopatra
Ubuntu:25.10
 All versions, plus listed versions
4:24.12.3-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.3-0ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu1
 None known
kleopatra
Ubuntu:26.10
 All versions, plus listed versions
4:25.12.3-0ubuntu14:26.04.2-14:26.04.2-24:26.04.3-0ubuntu14:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.1-0ubuntu1
 None known
kleopatra
Ubuntu:26.04:LTS
 All versions, plus listed versions
4:25.08.1-0ubuntu14:25.08.2-0ubuntu14:25.08.3-0ubuntu14:25.11.80-0ubuntu14:25.11.90-0ubuntu1
Show 7 moreShow less
4:25.12.0-0ubuntu14:25.12.0-0ubuntu24:25.12.1-0ubuntu14:25.12.1-0ubuntu24:25.12.2-0ubuntu14:25.12.2-0ubuntu24:25.12.3-0ubuntu1
 None known
kleopatra
openSUSE:Leap 15.1
 before 18.12.3-lp151.2.4.1
18.12.3-lp151.2.4.1
kleopatra
SUSE:Package Hub 15 SP1
 before 18.12.3-bp151.3.3.1
18.12.3-bp151.3.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSpiralBL0CK/CVE-2020-249722024-09-01

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24972 is a high vulnerability (CVSS 8.8) in Kleopatra Project Kleopatra, published August 29, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.85%, the 92nd percentile. Fixed in kleopatra 4:20.08.2-2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open