CVE-2025-30258

Name
CVE-2025-30258
Description
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
NVD Severity
low
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://dev.gnupg.org/T7527
cve@mitre.org https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158
cve@mitre.org https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html

Match rules

CPE URI Source package Min version Max version
gnupg >= 0 < 2.5.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
gnupg edge-main 2.4.7-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
gnupg edge-main 2.4.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable