9.8
Critical
CVE-2025-8454 It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts…
Description
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| devscripts | 0 | No fix stated |
References
- bugs.debian.org bugs.debian.org
Timeline
- Published
- Last modified