Critical Vulnerability in devscripts: OpenPGP Verification Bypass
Summary
UBUNTU-CVE-2025-8454: It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP ver... Affects devscripts versions 2.13.4 – 2.14.1ubuntu0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
devscripts is a collection of scripts designed to assist Debian package maintainers in their workflow. It includes tools for building, testing, and managing Debian packages. One of its components, uscan, is responsible for scanning upstream sources for new software releases. This tool is crucial for maintaining up-to-date packages, but it has been found to have a significant security flaw that compromises the integrity of the verification process.
Vulnerability Detail
The vulnerability arises from uscan's failure to perform OpenPGP verification on upstream sources if they have been previously downloaded, regardless of whether the verification was successful or not. This flaw can lead to the installation of unverified or malicious software, posing a severe risk to system security. The vulnerability affects multiple versions of devscripts across various Ubuntu LTS releases, with a CVSS score of 9.8 indicating a critical level of severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually verify the integrity of upstream sources before using them with uscan. This can be done by checking the OpenPGP signatures of the downloaded files against trusted keys. However, this is not a substitute for applying the patch.
Conclusion
The vulnerability in devscripts poses a critical risk due to its failure to properly verify upstream sources. Users are strongly advised to update their packages to the latest versions to ensure system integrity and security. Utilizing tools like Vulert can further enhance vulnerability management.
See every vulnerability recorded for devscripts →
FAQ
The vulnerability allows for the potential installation of unverified software, which can lead to system compromise and data breaches.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects devscripts versions 2.14.1ubuntu0.1, 2.16.2ubuntu3, 2.17.12ubuntu1.1, 2.20.2ubuntu2, 2.22.1ubuntu1, 2.23.7, and 2.25.5 across various Ubuntu LTS releases.
Yes, a patched version of devscripts is available. Users should update to at least version 2.22.1ubuntu1 to mitigate the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It provides real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for devscripts.
