diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg –use-embedded-filenames option is trusted.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Diffoscope | Ubuntu | bionic | * |
| Diffoscope | Ubuntu | mantic | * |
| Diffoscope | Ubuntu | upstream | * |
| Diffoscope | Ubuntu | xenial | * |