{"id":"CVE-2025-30258","aliases":["AZL-58932","AZL-58935","CLSA-2026-1774612633","CLSA-2026-1775119189","CLSA-2026-1776159098","DEBIAN-CVE-2025-30258","EUVD-2025-6762","GHSA-5rjg-pf4q-hgcr","JLSEC-2025-94","MGASA-2025-0133","OESA-2025-1375","OESA-2025-1376","OESA-2025-1521","OESA-2025-1522","OESA-2025-1523","ROOT-OS-DEBIAN-11-CVE-2025-30258","ROOT-OS-DEBIAN-12-CVE-2025-30258","SUSE-RU-2025:20460-1","SUSE-SU-2025:02259-1","SUSE-SU-2025:20209-1","SUSE-SU-2025:20444-1","SUSE-SU-2025:20454-1","SUSE-SU-2025:20458-1","SUSE-SU-2025:20465-1","SUSE-SU-2025:20472-1","SUSE-SU-2025:3986-1","UBUNTU-CVE-2025-30258","USN-7412-1","USN-7412-3","openSUSE-SU-2025:15076-1"],"status":"published","title":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data...","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00194,"percentile":0.09165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2025-03-19T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"gnupg2","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2","fixed_in":["2.3.3-2.el9_0.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2-smime","fixed_in":["2.3.3-2.el9_0.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","fixed_in":["2.3.3-4.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","fixed_in":["2.3.3-4.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"dirmngr","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-agent","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-l10n","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-utils","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg2","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-agent","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-wks-client","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-wks-server","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgconf","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgsm","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv-static","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv-win32","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv2","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"scdaemon","fixed_in":["2.2.12-1+deb10u2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.2.46-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.2.46-5"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuPG_jll","fixed_in":["2.4.8+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"gnupg2","fixed_in":["2.3.8-1.3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"gnupg2","fixed_in":["2.4.3-6.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","fixed_in":["2.4.3-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"gnupg2","fixed_in":["2.2.32-7.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","fixed_in":["2.2.32-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"gnupg2","fixed_in":["2.2.21-9.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"gnupg2","fixed_in":["2.2.27-2+deb11u3.aikido.4","2.2.27-2+deb11u3.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-gnupg2","fixed_in":["2.2.27-2+deb11u3.aikido.4","2.2.27-2+deb11u3.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"gnupg2","fixed_in":["2.2.40-1.1+deb12u2.root.io.5","2.2.40-1.1+deb12u2.root.io.1","2.2.40-1.1+deb12u2.root.io.4","2.2.40-1.1+deb12u2.aikido.6","2.2.40-1.1+deb12u2.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gnupg2","fixed_in":["2.2.40-1.1+deb12u2.root.io.5","2.2.40-1.1+deb12u2.root.io.1","2.2.40-1.1+deb12u2.root.io.4","2.2.40-1.1+deb12u2.aikido.6","2.2.40-1.1+deb12u2.aikido.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","fixed_in":["2.4.4-slfo.1.1_4.1","2.4.4-slfo.1.1_2.1","2.4.4-slfo.1.1_3.1","2.4.4-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gpg2","fixed_in":["2.4.4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","fixed_in":["2.4.4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gpg2","fixed_in":["2.4.4-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","fixed_in":["2.4.4-2.1","2.4.4-4.1","2.4.4-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gpg2","fixed_in":["2.2.27-150300.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gpg2","fixed_in":["2.2.27-150300.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gpg2","fixed_in":["2.2.27-150300.3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gpg2","fixed_in":["2.2.27-150300.3.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","fixed_in":["2.1.11-6ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnupg2","fixed_in":["2.2.4-1ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gnupg2","fixed_in":["2.2.19-3ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gnupg2","fixed_in":["2.2.27-3ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","fixed_in":["2.4.4-2ubuntu17.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"gnupg2","fixed_in":["2.4.4-2ubuntu23"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gpg2","fixed_in":["2.5.6-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.el9_0.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.el9_0.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"dirmngr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-wks-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-wks-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv-win32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"scdaemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1","2.2.40-1.1+deb12u1","2.2.40-1.1+deb12u2","2.2.40-1.1+hurd.1","2.2.40-1.1+loong64","2.2.40-2","2.2.40-3","2.2.43-1","2.2.43-2","2.2.43-3","2.2.43-4","2.2.43-5","2.2.43-6","2.2.43-7","2.2.43-8","2.2.44-1","2.2.45-1","2.2.45-2","2.2.45-3","2.2.46-1","2.2.46-2","2.2.46-3","2.2.46-4","2.2.46-5","2.2.46-6","2.2.46~pre1-1","2.3.1-1","2.4.3-2","2.4.4-1","2.4.4-2","2.4.4-3","2.4.4-4","2.4.5-1","2.4.5-2","2.4.5-3","2.4.6-1","2.4.7-1","2.4.7-10","2.4.7-11","2.4.7-12","2.4.7-13","2.4.7-14","2.4.7-15","2.4.7-16","2.4.7-17","2.4.7-18","2.4.7-19","2.4.7-2","2.4.7-20","2.4.7-21","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.7-7","2.4.7-8","2.4.7-9","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.46-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.46-5"}]}]},{"source":"osv","ecosystem":"Julia","package":"GnuPG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.8+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-1.3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-6.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.32-7.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.32-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.21-9.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2+deb11u3.aikido.4"},{"fixed":"2.2.27-2+deb11u3.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2+deb11u3.aikido.4"},{"fixed":"2.2.27-2+deb11u3.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.40-1.1+deb12u2.root.io.5"},{"fixed":"2.2.40-1.1+deb12u2.root.io.1"},{"fixed":"2.2.40-1.1+deb12u2.root.io.4"},{"fixed":"2.2.40-1.1+deb12u2.aikido.6"},{"fixed":"2.2.40-1.1+deb12u2.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.40-1.1+deb12u2.root.io.5"},{"fixed":"2.2.40-1.1+deb12u2.root.io.1"},{"fixed":"2.2.40-1.1+deb12u2.root.io.4"},{"fixed":"2.2.40-1.1+deb12u2.aikido.6"},{"fixed":"2.2.40-1.1+deb12u2.aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-150300.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-150300.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-150300.3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-150300.3.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-6ubuntu2.1+esm2"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2","2.1.11-6ubuntu2.1","2.1.11-6ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.6+esm1"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2","2.2.4-1ubuntu1.3","2.2.4-1ubuntu1.4","2.2.4-1ubuntu1.5","2.2.4-1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-3ubuntu2.4"}]}],"versions":["2.2.12-1ubuntu3","2.2.17-3ubuntu1","2.2.19-3ubuntu2","2.2.19-3ubuntu2.1","2.2.19-3ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-3ubuntu2.3"}]}],"versions":["2.2.20-1ubuntu4","2.2.27-2ubuntu1","2.2.27-3ubuntu1","2.2.27-3ubuntu2","2.2.27-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu17.2"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu23"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-3ubuntu2.4"}]}],"versions":["2.2.12-1ubuntu3","2.2.17-3ubuntu1","2.2.19-3ubuntu2","2.2.19-3ubuntu2.1","2.2.19-3ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-3ubuntu2.3"}]}],"versions":["2.2.20-1ubuntu4","2.2.27-2ubuntu1","2.2.27-3ubuntu1","2.2.27-3ubuntu2","2.2.27-3ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu17.2"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-6ubuntu2.1+esm2"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2","2.1.11-6ubuntu2.1","2.1.11-6ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.6+esm1"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2","2.2.4-1ubuntu1.3","2.2.4-1ubuntu1.4","2.2.4-1ubuntu1.5","2.2.4-1ubuntu1.6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.6-1.1"}]}]}],"products":[{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html","tags":["Mailing List","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://dev.gnupg.org/T7527","tags":["Exploit","Issue Tracking","report","web"]},{"url":"https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158","tags":["Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30258","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5rjg-pf4q-hgcr"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1774612633.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775119189.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1776159098.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30258","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0133.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34165","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7412-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1375","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1376","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1521","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1522","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1523","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202520460-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236931","tags":["report"]},{"url":"https://bugzilla.suse.com/1239119","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30258","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239817","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520209-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520444-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520454-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520458-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520465-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243069","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520472-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253986-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30258","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7412-3","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YD56XCHKWUVJGX23UE76DVQAUBMLQGTG/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T00:00:00Z","modified":"2025-03-19T20:49:22.417Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-6762","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T00:00:00Z","modified":"2025-03-19T20:49:22Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:52:58.209763Z"}],"ghsa":[{"id":"GHSA-5rjg-pf4q-hgcr","title":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data...","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T21:30:52Z","modified":"2025-03-19T21:31:04Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:00:21.948026Z"}],"nvd":[{"id":"CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:20.14Z","modified":"2026-06-17T09:08:24.79Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:20.14Z","modified":"2026-04-16T04:40:32.283137769Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:20.14Z","modified":"2026-09-01T20:05:45.577298482Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"JLSEC-2025-94","title":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data...","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-10-17T22:31:47.919Z","modified":"2026-07-25T18:23:46.012002174Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2025-1375","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \u0026quot;verification DoS.\u0026quot;(CVE-2025-30258)","status":"published","published":"2025-04-03T11:08:28Z","modified":"2026-08-18T01:17:51.001580069Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1376","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \u0026quot;verification DoS.\u0026quot;(CVE-2025-30258)","status":"published","published":"2025-04-03T11:08:28Z","modified":"2026-08-18T01:17:51.024510115Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1521","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \u0026quot;verification DoS.\u0026quot;(CVE-2025-30258)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.957522268Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1522","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \u0026quot;verification DoS.\u0026quot;(CVE-2025-30258)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.837475781Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1523","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \u0026quot;verification DoS.\u0026quot;(CVE-2025-30258)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.822466392Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-30258","title":"CVE-2025-30258 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-30258 in the gnupg2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:36:47Z","modified":"2026-10-07T15:16:00.569904257Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:29.356832Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-30258","title":"CVE-2025-30258 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-30258 in the gnupg2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:38:14Z","modified":"2026-10-07T15:16:02.183606606Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"UBUNTU-CVE-2025-30258","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:00Z","modified":"2026-02-04T04:30:17.426918Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"AZL-58932","title":"CVE-2025-30258 affecting package gnupg2 2.4.0-3","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:20Z","modified":"2026-04-21T04:37:10.47106Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-58935","title":"CVE-2025-30258 affecting package gnupg2 for versions less than 2.4.8-1","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"","status":"published","published":"2025-03-19T20:15:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"CLSA-2026-1774612633","title":"gnupg2: Fix of CVE-2025-30258","description":"- CVE-2025-30258: fix verification DoS due to a malicious subkey in the keyring","status":"published","published":"2026-03-27T11:57:17Z","modified":"2026-06-01T00:32:11.250453198Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775119189","title":"gnupg2: Fix of CVE-2025-30258","description":"- CVE-2025-30258: fix verification DoS due to a malicious subkey in the keyring","status":"published","published":"2026-04-02T19:42:29Z","modified":"2026-06-01T00:32:46.349512706Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776159098","title":"Fix CVE(s): CVE-2025-30258","description":"   * SECURITY UPDATE: signature verification DoS via malicious subkey\n     - debian/patches/CVE-2025-30258.patch: require signing usage when\n       looking up public key for signature verification, filtering out\n       subkeys without valid backsig. Include upstream regression fixes\n       to preserve verification of signatures from expired/revoked keys.\n       Widen pubkey_usage and req_usage fields from byte to u16 to\n       prevent PUBKEY_USAGE_VERIFY (16384) from being truncated on\n       GnuPG 2.2.x. Add primary-key-only lookup during import to\n       prevent malicious subkey attack at import time. Fix double-free\n       in check_signature_over_key_or_uid when signer is caller-owned.\n     - CVE-2025-30258","status":"published","published":"2026-04-14T09:31:43Z","modified":"2026-06-04T10:03:54.618898Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"MGASA-2025-0133","title":"Updated gnupg2 packages fix security vulnerability","description":"In GnuPG before 2.5.5, if a user chooses to import a certificate with\ncertain crafted subkey data that lacks a valid backsig or that has\nincorrect usage flags, the user loses the ability to verify signatures\nmade from certain other signing keys, aka a \"verification DoS\".\n(CVE-2025-30258)\n","status":"published","published":"2025-04-12T04:23:49Z","modified":"2026-05-16T06:31:03.800836Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15076-1","title":"dirmngr-2.5.6-1.1 on GA media","description":"These are all security issues fixed in the dirmngr-2.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-12T00:00:00Z","modified":"2026-03-23T04:53:22.057997Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-RU-2025:20460-1","title":"Recommended update for gpg2","description":"This update for gpg2 fixes the following issues:\n\nThis reverts the CVE-2025-30258 fix, as it changed behaviour when using expired keys.\n","status":"published","published":"2025-07-01T11:27:44Z","modified":"2026-03-23T04:48:23.87194Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:02259-1","title":"Recommended update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2025-30258: Fixed DoS due to a malicious subkey in the keyring (bsc#1239119).\n\nOther bugfixes:\n\n- Do not install expired sks certificate (bsc#1243069).\n- gpg hangs when importing a key (bsc#1236931).\n","status":"published","published":"2025-07-09T15:18:03Z","modified":"2026-03-23T04:47:42.471091Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20209-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2025-30258: Fixed DoS due to a malicious subkey in the keyring (bsc#1239119)\n","status":"published","published":"2025-04-29T11:11:44Z","modified":"2026-03-23T04:48:53.977175Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20444-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2025-30258: Fixed a verification DoS due to a malicious subkey in the keyring. (bsc#1239119)\n","status":"published","published":"2025-06-23T13:33:24Z","modified":"2026-03-23T04:48:58.125201Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20454-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n* Fix regression for the recent malicious subkey DoS fix in CVE-2025-30258. [bsc#1236931, bsc#1239119, CVE-2025-30258]\n","status":"published","published":"2025-06-30T08:20:23Z","modified":"2026-03-23T04:48:16.883888Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20458-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n* Fixed regressions for the recent malicious subkey DoS fix for CVE-2025-30258 (bsc#1239119).\n","status":"published","published":"2025-06-30T08:30:22Z","modified":"2026-03-23T04:50:09.42287Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20465-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- gpg: Allow the use of an ADSK subkey as ADSK subkey. (bsc#1239119 CVE-2025-30258)\n- Don't install expired sks certificate [bsc#1243069]\n","status":"published","published":"2025-07-04T09:02:09Z","modified":"2026-03-23T04:48:58.176376Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20472-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2025-30258: Fix a verification DoS due to a malicious subkey in the keyring: [bsc#1239119, bsc#1236931]]\n  * gpg: Fix regression for the recent malicious subkey DoS fix.\n  * gpg: Fix another regression due to the T7547 fix.\n  * gpg: Allow the use of an ADSK subkey as ADSK subkey.\n\n- Don't install expired sks certificate [bsc#1243069]\n","status":"published","published":"2025-07-08T16:15:17Z","modified":"2026-03-23T04:48:17.52516Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:3986-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n  - CVE-2025-30258: fixed a verification denial of service due to a malicious subkey in the keyring (bsc#1239119) \n","status":"published","published":"2025-11-07T10:31:06Z","modified":"2026-03-23T04:51:22.711729Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7412-1","title":"gnupg2 vulnerability","description":"It was discovered that GnuPG incorrectly handled importing keys with\ncertain crafted subkey data. If a user or automated system were tricked\ninto importing a specially crafted key, a remote attacker may prevent users\nfrom importing other keys in the future.\n","status":"published","published":"2025-04-03T12:17:17Z","modified":"2026-02-10T04:47:47Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7412-3","title":"gnupg2 vulnerability","description":"USN-7412-1 fixed a vulnerability in GnuPG. This update provides the\ncorresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that GnuPG incorrectly handled importing keys with\n certain crafted subkey data. If a user or automated system were tricked\n into importing a specially crafted key, a remote attacker may prevent\n users from importing other keys in the future.\n","status":"published","published":"2025-12-09T05:14:53Z","modified":"2026-06-25T13:32:30.21378163Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}