Directory Traversal Vulnerability in Diffoscope Package
Summary
UBUNTU-CVE-2024-25711: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Affects diffoscope versions 33 – 51. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Diffoscope is a powerful tool used for comparing files and directories, providing detailed insights into differences between them. It is widely utilized in various applications for file analysis and debugging. However, a critical vulnerability has been identified in versions prior to 256, which exposes users to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2024-25711, allows for directory traversal through an embedded filename in a GPG file. This means that an attacker could exploit this flaw to access sensitive files on the system, such as private SSH keys located at ../.ssh/id_rsa. The issue arises from the trust placed in the gpg --use-embedded-filenames option, which can be manipulated to disclose the contents of any file. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the gpg --use-embedded-filenames option until the package is updated. This will help prevent the exploitation of the directory traversal vulnerability.
Conclusion
The directory traversal vulnerability in the Diffoscope package poses a significant security risk, allowing unauthorized access to sensitive files. Users are strongly advised to update to the latest version to protect their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for diffoscope →
FAQ
CVE-2024-25711 is a directory traversal vulnerability found in the Diffoscope package that allows attackers to access sensitive files on the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could lead to unauthorized access to sensitive files, potentially compromising user data and system security.
Yes, a patched version of the Diffoscope package is available. Users should update to version 256 or later to mitigate the vulnerability.
If an immediate update is not possible, consider avoiding the use of the gpg --use-embedded-filenames option as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
