Hi Andreas, On Sun, Oct 11, 2026 at 07:33:44AM +0200, Andreas Metzler wrote: > On 2026-10-06 Salvatore Bonaccorso <[email protected]> wrote: > > Source: gnupg2 > > Version: 2.4.9-7 > > X-Debbugs-CC: [email protected] > > Severity: important > > Tags: security upstream > > > Hi, > > > The following vulnerability was published for gnupg2. > > > CVE-2026-105712[0]: > > | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted > > | data in an archive. When extracting an untrusted archive with > > | --directory (aka -C) into an existing directory containing a pre- > > | existing symlink, gpgtar can follow that symlink and create or > > | overwrite a file outside the selected extraction directory. The > > | write is limited by the extraction user's filesystem permissions. An > > | archive extracted into a fresh empty directory does not have this > > | risk. > > > > If you fix the vulnerability please also make sure to include the > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > [...] > > Good morning, > > I suspect this is not worth a DSA?
Correct, we marked it as no-dsa and the update can go ideally into the next trixie point release instread (if you have time for it!) Thanks a lot for your work! Rgards, Salvatore
