← voltar
CVE-2025-30258

CVE-2025-30258

CVSS 2.7 LOWEPSS 0.2%CWE-754
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L
Produtos afetados
GnuPG · GnuPG

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158https://dev.gnupg.org/T7527https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html