CVE-2025-30258
EUVD-2025-676219.03.2025, 20:15
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gnupg | gnupg | 𝑥 < 2.4.8 |
| gnupg | gnupg | 2.5.0 ≤ 𝑥 < 2.5.5 |
𝑥
= Vulnerable software versions
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| dirmngr |
| ||||||||||||||
| gpg2 |
| ||||||||||||||
| gpg2-lang |
|
Common Weakness Enumeration