Every CVE Search/ Get API key

CVE-2025-8454

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software,...

9.8 Critical

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.27%Up 0.3 points since Aug 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2025-23342 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
EUVD-2025-23342
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mw9f-f52p-chpp 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software,...

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.

Record
GHSA-mw9f-f52p-chpp
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
NVD 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-347
Updated
2026-11-02
OSVBELL-CVE-2025-8454 9.8

CVE-2025-8454 does not affect BellSoft software

Record
BELL-CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-8454 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
DEBIAN-CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-8454 9.8

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

Record
UBUNTU-CVE-2025-8454
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
devscripts
Debian:12
 All versions, plus listed versions
2.23.42.23.4+deb12u12.23.4+deb12u22.23.52.23.5~bpo11+1
Show 45 moreShow less
2.23.62.23.6~bpo11+12.23.72.23.7~bpo11+12.24.12.24.102.24.22.24.32.24.42.24.52.24.62.24.72.24.82.24.92.25.12.25.102.25.10~bpo12+12.25.112.25.122.25.132.25.142.25.152.25.15~bpo12+12.25.162.25.172.25.182.25.192.25.19~bpo13+12.25.22.25.202.25.212.25.222.25.22~bpo13+12.25.232.25.242.25.252.25.262.25.272.25.282.25.292.25.32.25.302.25.312.25.322.25.33
 None known
devscripts
Debian:13
 All versions, plus listed versions
2.25.152.25.15+deb13u12.25.162.25.172.25.18
Show 32 moreShow less
2.25.192.25.19~bpo13+12.25.202.25.212.25.222.25.22~bpo13+12.25.232.25.242.25.252.25.262.25.272.25.282.25.292.25.302.25.312.25.322.25.332.26.12.26.102.26.112.26.11~bpo13+12.26.22.26.32.26.42.26.52.26.62.26.6~bpo13+12.26.72.26.7~bpo13+12.26.82.26.92.26.9~bpo13+1
 None known
devscripts
Debian:14
 All versions, plus listed versions
2.25.152.25.162.25.172.25.182.25.19
Show 31 moreShow less
2.25.19~bpo13+12.25.202.25.212.25.222.25.22~bpo13+12.25.232.25.242.25.252.25.262.25.272.25.282.25.292.25.302.25.312.25.322.25.332.26.12.26.102.26.112.26.11~bpo13+12.26.22.26.32.26.42.26.52.26.62.26.6~bpo13+12.26.72.26.7~bpo13+12.26.82.26.92.26.9~bpo13+1
 None known
devscripts
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.13.42.13.4build12.13.8git12.13.92.14.12.14.1ubuntu0.1
 None known
devscripts
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.15.8ubuntu12.15.9ubuntu22.15.9ubuntu32.16.2ubuntu3
 None known
devscripts
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.17.9build12.17.10ubuntu12.17.112.17.12ubuntu12.17.12ubuntu1.1
 None known
devscripts
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.19.6ubuntu12.19.7ubuntu22.20.1ubuntu12.20.2ubuntu2
 None known
devscripts
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.21.4ubuntu12.21.4ubuntu22.22.1ubuntu12.22.1ubuntu1.2
 None known
devscripts
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.23.62.23.6build12.23.72.23.7ubuntu0.12.23.7ubuntu0.2
 None known
devscripts
Ubuntu:25.10
 All versions, plus listed versions
2.25.52.25.112.25.122.25.132.25.142.25.152.25.19ubuntu12.25.19ubuntu2
 None known
devscripts
Ubuntu:26.10
 All versions, plus listed versions
2.26.72.26.92.26.102.26.112.26.11ubuntu1
 None known
devscripts
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.25.19ubuntu22.25.262.25.272.25.302.25.31
Show 5 moreShow less
2.26.42.26.52.26.5ubuntu12.26.6ubuntu12.26.7
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8454 is a critical vulnerability (CVSS 9.8) in Debian Devscripts, published August 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 20th percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 22 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open