Executive brief
diffoscope is a tool used by software developers and security teams to compare files and identify differences in binary packages and archives. A flaw in how it processes GPG files allows an attacker to read arbitrary files from the system (such as private SSH keys) by crafting a malicious GPG file with directory traversal sequences in embedded filenames. This could lead to disclosure of sensitive credentials and configuration data.
Technical details
The vulnerability is a path traversal flaw in diffoscope's handling of GPG files when the gpg --use-embedded-filenames option is enabled. The application trusts the embedded filename values from GPG archives without proper sanitization, allowing sequences like ../ to escape the intended extraction directory. An attacker can craft a malicious GPG file containing embedded filenames with directory traversal payloads, enabling extraction and disclosure of arbitrary files readable by the diffoscope process. The flaw affects all versions prior to 256, which introduced proper path validation. Exploitation requires the attacker to control or inject a GPG file processed by diffoscope.
Affected products
- diffoscope diffoscope before 256
Timeline
- 2024-02-27: disclosed
- 2024: patched: Fixed in version 256