{"id":"CVE-2025-8454","aliases":["BELL-CVE-2025-8454","DEBIAN-CVE-2025-8454","EUVD-2025-23342","GHSA-mw9f-f52p-chpp","UBUNTU-CVE-2025-8454"],"status":"published","title":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software,...","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00275,"percentile":0.20103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2025-08-01T05:41:09Z","modified":"2026-10-17T12:57:46Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.4","2.23.4+deb12u1","2.23.4+deb12u2","2.23.5","2.23.5~bpo11+1","2.23.6","2.23.6~bpo11+1","2.23.7","2.23.7~bpo11+1","2.24.1","2.24.10","2.24.2","2.24.3","2.24.4","2.24.5","2.24.6","2.24.7","2.24.8","2.24.9","2.25.1","2.25.10","2.25.10~bpo12+1","2.25.11","2.25.12","2.25.13","2.25.14","2.25.15","2.25.15~bpo12+1","2.25.16","2.25.17","2.25.18","2.25.19","2.25.19~bpo13+1","2.25.2","2.25.20","2.25.21","2.25.22","2.25.22~bpo13+1","2.25.23","2.25.24","2.25.25","2.25.26","2.25.27","2.25.28","2.25.29","2.25.3","2.25.30","2.25.31","2.25.32","2.25.33","2.25.4","2.25.5","2.25.6","2.25.7","2.25.8","2.25.8~bpo12+1","2.25.9","2.26.1","2.26.10","2.26.11","2.26.11~bpo13+1","2.26.2","2.26.3","2.26.4","2.26.5","2.26.6","2.26.6~bpo13+1","2.26.7","2.26.7~bpo13+1","2.26.8","2.26.9","2.26.9~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.15","2.25.15+deb13u1","2.25.16","2.25.17","2.25.18","2.25.19","2.25.19~bpo13+1","2.25.20","2.25.21","2.25.22","2.25.22~bpo13+1","2.25.23","2.25.24","2.25.25","2.25.26","2.25.27","2.25.28","2.25.29","2.25.30","2.25.31","2.25.32","2.25.33","2.26.1","2.26.10","2.26.11","2.26.11~bpo13+1","2.26.2","2.26.3","2.26.4","2.26.5","2.26.6","2.26.6~bpo13+1","2.26.7","2.26.7~bpo13+1","2.26.8","2.26.9","2.26.9~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.15","2.25.16","2.25.17","2.25.18","2.25.19","2.25.19~bpo13+1","2.25.20","2.25.21","2.25.22","2.25.22~bpo13+1","2.25.23","2.25.24","2.25.25","2.25.26","2.25.27","2.25.28","2.25.29","2.25.30","2.25.31","2.25.32","2.25.33","2.26.1","2.26.10","2.26.11","2.26.11~bpo13+1","2.26.2","2.26.3","2.26.4","2.26.5","2.26.6","2.26.6~bpo13+1","2.26.7","2.26.7~bpo13+1","2.26.8","2.26.9","2.26.9~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.4","2.13.4build1","2.13.8git1","2.13.9","2.14.1","2.14.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.8ubuntu1","2.15.9ubuntu2","2.15.9ubuntu3","2.16.2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.9build1","2.17.10ubuntu1","2.17.11","2.17.12ubuntu1","2.17.12ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.6ubuntu1","2.19.7ubuntu2","2.20.1ubuntu1","2.20.2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21.4ubuntu1","2.21.4ubuntu2","2.22.1ubuntu1","2.22.1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.6","2.23.6build1","2.23.7","2.23.7ubuntu0.1","2.23.7ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.5","2.25.11","2.25.12","2.25.13","2.25.14","2.25.15","2.25.19ubuntu1","2.25.19ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.7","2.26.9","2.26.10","2.26.11","2.26.11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"devscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.19ubuntu2","2.25.26","2.25.27","2.25.30","2.25.31","2.26.4","2.26.5","2.26.5ubuntu1","2.26.6ubuntu1","2.26.7"]}],"products":[{"vendor":"debian","product":"devscripts"}],"references":[{"url":"https://bugs.debian.org/1109251","tags":["Issue Tracking","Mailing List","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8454"},{"url":"https://github.com/advisories/GHSA-mw9f-f52p-chpp"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-8454","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-8454","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-8454","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8454","tags":["report"]},{"url":"https://salsa.debian.org/debian/devscripts/-/merge_requests/552","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-8454","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T05:41:09.361Z","modified":"2025-08-01T13:47:20.337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-23342","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T05:41:09Z","modified":"2025-08-01T13:47:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:02.018241Z"}],"ghsa":[{"id":"GHSA-mw9f-f52p-chpp","title":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software,...","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.","status":"published","published":"2025-08-01T06:31:37Z","modified":"2025-08-01T15:34:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:03:09.647668Z"}],"nvd":[{"id":"CVE-2025-8454","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T06:15:29.493Z","modified":"2026-06-17T10:07:01.327Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"BELL-CVE-2025-8454","title":"CVE-2025-8454 does not affect BellSoft software","status":"withdrawn","published":"2025-08-05T06:05:11.73588Z","modified":"2026-01-26T09:49:57.008973Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-8454","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T06:15:29.493Z","modified":"2026-04-10T05:36:17.111003Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-8454","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T06:15:29.493Z","modified":"2026-09-01T20:05:59.005012148Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"UBUNTU-CVE-2025-8454","description":"It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.","status":"published","published":"2025-08-01T06:15:00Z","modified":"2026-10-17T12:57:46.122964965Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:55.926217Z"}]}}