Directory Traversal Vulnerability in diffoscope Package
Summary
DEBIAN-CVE-2024-25711: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Affects diffoscope versions < 256. Fixed in 256. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
diffoscope is a powerful tool used in Debian systems to compare files and directories, providing detailed reports on differences. It is particularly useful for developers and system administrators who need to analyze changes in files, including binary files and archives. However, prior to version 256, diffoscope is susceptible to a directory traversal vulnerability that can expose sensitive files on the system.
Vulnerability Detail
The vulnerability in diffoscope arises from its handling of embedded filenames in GPG files. Specifically, the gpg --use-embedded-filenames option is trusted, allowing an attacker to exploit this trust and perform directory traversal. This means that an attacker could potentially access sensitive files, such as private SSH keys located at ../.ssh/id_rsa, leading to unauthorized access and data breaches. The vulnerability affects versions of diffoscope before 256.
How To Fix
Minimum fixed version
256
This is the first release that contains the fix.
sudo apt-get install --only-upgrade diffoscopeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using GPG files with embedded filenames until they can update to the patched version. Additionally, ensure that sensitive files are not accessible to unauthorized users.
Conclusion
The directory traversal vulnerability in the diffoscope package poses a significant risk by allowing unauthorized access to sensitive files. It is crucial for users to update to version 256 or later to mitigate this risk. Until then, users should implement workarounds to protect their systems.
See every vulnerability recorded for diffoscope →
FAQ
The vulnerability allows directory traversal through embedded filenames in GPG files, potentially exposing sensitive files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
All versions of diffoscope prior to version 256 are affected by this vulnerability.
As a workaround, avoid using GPG files with embedded filenames and restrict access to sensitive files.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-25711.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
