Directory Traversal Vulnerability in diffoscope: Potential Disclosure of Sensitive Files
Summary
CVE-2024-25711: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Affects diffoscope versions 177 – 302. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
diffoscope is a tool designed to compare files and directories, providing detailed output on differences. It is widely used in software development and security auditing to identify changes between versions of files. The tool supports various file formats, including GPG files, which can contain sensitive information. The vulnerability in question arises from the handling of embedded filenames in GPG files, which can lead to unauthorized access to sensitive files on the system.
Vulnerability Detail
The vulnerability, identified as CVE-2024-25711, allows for directory traversal through an embedded filename in a GPG file. This occurs because the gpg --use-embedded-filenames option is trusted without proper validation. An attacker can exploit this vulnerability to access sensitive files, such as private SSH keys located in directories like ../.ssh/id_rsa. The potential ramifications include unauthorized access to sensitive data, which could lead to further exploitation of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using GPG files with embedded filenames until the software is updated. Additionally, restricting access to sensitive files and monitoring for unauthorized access attempts can help mitigate the risk.
Conclusion
The directory traversal vulnerability in diffoscope (CVE-2024-25711) poses a significant risk by allowing unauthorized access to sensitive files through improperly validated embedded filenames in GPG files. Users are strongly advised to upgrade to version 256 or later to mitigate this risk.
See every vulnerability recorded for diffoscope →
FAQ
CVE-2024-25711 is a vulnerability in diffoscope that allows directory traversal via an embedded filename in a GPG file, potentially disclosing sensitive files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, avoid using GPG files with embedded filenames and restrict access to sensitive files as a temporary measure.
Files such as private SSH keys, configuration files, and other sensitive documents located in accessible directories could be exposed.
Yes, if an attacker can manipulate GPG files processed by diffoscope, they could exploit this vulnerability to access sensitive files remotely.
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
