{"id":"CVE-2024-25711","aliases":["ALPINE-CVE-2024-25711","DEBIAN-CVE-2024-25711","EUVD-2024-0035","GHSA-33w6-hvmq-gh4x","PYSEC-2024-41","UBUNTU-CVE-2024-25711","openSUSE-SU-2024:13792-1"],"status":"published","title":"diffoscope Path Traversal vulnerability","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00979,"percentile":0.62688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-02-11T00:00:00Z","modified":"2026-11-03T06:32:45Z","fixes":[{"ecosystem":"PyPI","package":"diffoscope","fixed_in":["256"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.19","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"diffoscope","fixed_in":["256-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"diffoscope","fixed_in":["256"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"diffoscope","fixed_in":["256"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"diffoscope","fixed_in":["261-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["240","240+deb12u1","241","242","243","244","245","246","247","248","249","250","251","252","253","254","255","256","257","258","259","260","261","262","263","264","265","266","267","268","269","270","271","272","273","274","275","276","277","278","279","280","281","282","283","284","285","286","287","288","289","290","291","292","293","294","295","296","297","298","299","300","301","302","303","304","305","306","306~bpo13+1","307","308","309","310","311","312","313","314","315","316","317","318","319","320","321","322","323","324","325","326","327","328","329","330","331","332","333","334","335","336"]},{"source":"osv","ecosystem":"Debian:13","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256"}]}]},{"source":"osv","ecosystem":"PyPI","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256"}]}],"versions":["100","101","102","103","104","105","106","107","108","110","111","112","113","114","115","116","117","118","119","120","121","122","123","124","125","126","127","128","129","130","131","132","133","134","135","136","137","138","139","140","141","142","143","144","145","146","147","148","149","150","151","152","153","154","155","156","157","158","159","160","161","162","163","164","165","166","167","168","169","170","171","172","173","174","175","176","177","178","179","180","181","182","183","184","185","186","187","188","189","190","191","192","193","194","195","196","197","198","199","200","201","202","203","204","205","206","207","208","209","210","211","212","213","214","215","216","217","218","219","220","221","222","223","224","226","227","228","229","230","231","232","233","234","235","236","237","238","239","240","241","242","243","244","245","246","247","248","249","250","251","252","253","254","255","39","40","41","42","43","44","45","46","47","48","49","51","52","54","55","56","59","60","61","62","63","64","65","66","67","68","69","70","71","72","73","74","75","76","77","78","79","80","81","82","83","84","85","86","87","88","89","90","91","92","93","94","95","96","97","98","99"]},{"source":"osv","ecosystem":"PyPI","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"256"}]}],"versions":["100","101","102","103","104","105","106","107","108","110","111","112","113","114","115","116","117","118","119","120","121","122","123","124","125","126","127","128","129","130","131","132","133","134","135","136","137","138","139","140","141","142","143","144","145","146","147","148","149","150","151","152","153","154","155","156","157","158","159","160","161","162","163","164","165","166","167","168","169","170","171","172","173","174","175","176","177","178","179","180","181","182","183","184","185","186","187","188","189","190","191","192","193","194","195","196","197","198","199","200","201","202","203","204","205","206","207","208","209","210","211","212","213","214","215","216","217","218","219","220","221","222","223","224","226","227","228","229","230","231","232","233","234","235","236","237","238","239","240","241","242","243","244","245","246","247","248","249","250","251","252","253","254","255","39","40","41","42","43","44","45","46","47","48","49","51","52","54","55","56","59","60","61","62","63","64","65","66","67","68","69","70","71","72","73","74","75","76","77","78","79","80","81","82","83","84","85","86","87","88","89","90","91","92","93","94","95","96","97","98","99"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["33","38","41","42","48","49","51"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["87","88","90build1","91build1","91ubuntu1","92ubuntu1","93ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["125","131","132","133","134","135","136","137"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["180","194build","195","200","201","202","203","204","205"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["249","251","253","254","255","257","258","259"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"diffoscope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"261-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"reproducible_builds","product":"diffoscope"}],"references":[{"url":"https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e","tags":["x_transferred","Patch","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/","tags":["vendor-advisory","x_transferred","Mailing List","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25711","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2024-41.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-33w6-hvmq-gh4x","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-25711","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-25711","tags":["advisory"]},{"url":"https://salsa.debian.org/reproducible-builds/diffoscope","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-25711","tags":["report"]},{"url":"https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/458f7f04bc053a0066aa7d2fd3251747d4899476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-25711","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25711","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-11T00:00:00Z","modified":"2025-11-04T18:29:37.954Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:04.341725Z"}],"euvd":[{"id":"EUVD-2024-0035","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-11T00:00:00Z","modified":"2025-11-04T18:29:37Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:23.723839Z"}],"ghsa":[{"id":"GHSA-33w6-hvmq-gh4x","title":"diffoscope Path Traversal vulnerability","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T03:31:03Z","modified":"2024-02-27T21:48:55Z","updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:06.763Z","modified":"2026-06-17T07:16:27.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"ALPINE-CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:06.763Z","modified":"2026-11-03T06:32:45.462109103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:06.763Z","modified":"2026-03-14T12:27:33.1825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:06.763Z","modified":"2026-11-02T12:01:04.671084215Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-25711","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:00Z","modified":"2025-10-24T05:06:57Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"GHSA-33w6-hvmq-gh4x","title":"diffoscope Path Traversal vulnerability","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T03:31:03Z","modified":"2024-12-05T05:37:11.490459Z","updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"openSUSE-SU-2024:13792-1","title":"diffoscope-261-1.1 on GA media","description":"These are all security issues fixed in the diffoscope-261-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:30:36.792364Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"PYSEC-2024-41","description":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.","status":"published","published":"2024-02-27T02:15:00Z","modified":"2026-06-10T17:00:45.002468596Z","updated_at":"2026-11-02T15:52:54.242332Z"}]}}