Homepage
About Snyk

diffoscope@202 vulnerabilities

in-depth comparison of files, archives, and directories

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the diffoscope package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Directory Traversal

diffoscope is a tool to get to the bottom of what makes files or directories different.

Affected versions of this package are vulnerable to Directory Traversal due to the improper handling of embedded filenames in GPG files. An attacker can disclose the contents of any file on the system, such as sensitive SSH private keys, by crafting a GPG file that specifies a path traversal in the embedded filename. This vulnerability leverages the --use-embedded-filenames option of GPG, which is incorrectly trusted to specify safe file paths.

How to fix Directory Traversal?

Upgrade diffoscope to version 256 or higher.

[,256)
Go back to all versions of this package