Reproducible Builds vulnerabilities
We track 1 vulnerability in Reproducible Builds products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2024.
1vulnerabilities
0critical
1high
0exploited
7.5average CVSS score
Latest Reproducible Builds vulnerabilities
- 7.5 High severity
Diffoscope: Improper Limitation of a Pathname to a Restricted Directory
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.