CVE-2020-24972

Katalog CVE

CVSS 8.8 · High EPSS 4,8%

Kerentanan Improper Encoding or Escaping of Output pada kleopatra project kleopatra, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Rincian

Terbit di NVD

29 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

4,8% peluang dieksploitasi; lebih tinggi dari 91,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b patch · advisory vendor
• https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt exploit · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html broken link · mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html broken link · mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202008-21 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVW...