Source: gnupg2 Version: 2.4.9-7 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for gnupg2. CVE-2026-105712[0]: | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted | data in an archive. When extracting an untrusted archive with | --directory (aka -C) into an existing directory containing a pre- | existing symlink, gpgtar can follow that symlink and create or | overwrite a file outside the selected extraction directory. The | write is limited by the extraction user's filesystem permissions. An | archive extracted into a fresh empty directory does not have this | risk. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-105712 https://www.cve.org/CVERecord?id=CVE-2026-105712 [1] https://static.dev.gnupg.org/T8159.html [2] https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html [3] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
