CVE-2025-30258
Fixed in a distro release EPSS <1%CVSS 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | gnupg2 | 2.3.7-1.amzn2023.0.5 |
| Amazon Linux 2023 | gnupg2-minimal | 2.3.7-1.amzn2023.0.5 |
| Amazon Linux 2023 | gnupg2-smime | 2.3.7-1.amzn2023.0.5 |
| Chainguard | gnupg | 2.4.8-r1 |
| Chainguard | gnupg-dirmngr | 2.4.8-r1 |
| Chainguard | gnupg-doc | 2.4.8-r1 |
| Chainguard | gnupg-gpgconf | 2.4.8-r1 |
| Chainguard | gnupg-lang | 2.4.8-r1 |
| Chainguard | gnupg-scdaemon | 2.4.8-r1 |
| Chainguard | gnupg-utils | 2.4.8-r1 |
| Chainguard | gnupg-wks-client | 2.4.8-r1 |
| Chainguard | gpg | 2.4.8-r1 |
| Chainguard | gpg-agent | 2.4.8-r1 |
| Chainguard | gpg-wks-server | 2.4.8-r1 |
| Chainguard | gpgsm | 2.4.8-r1 |
| Chainguard | gpgv | 2.4.8-r1 |
| Debian 12 | gnupg2 | no fix |
| Debian 13 | gnupg2 | 2.2.46-5 |
| Debian 14 | gnupg2 | 2.2.46-5 |
| SUSE Linux Enterprise Micro 5.2 | gpg2 | 2.2.27-150300.3.13.1 |
| SUSE Linux Enterprise Micro 5.3 | gpg2 | 2.2.27-150300.3.13.1 |
| SUSE Linux Enterprise Micro 5.4 | gpg2 | 2.2.27-150300.3.13.1 |
| SUSE Linux Enterprise Micro 5.5 | gpg2 | 2.2.27-150300.3.13.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | gpg2 | 2.4.4-150600.3.9.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | gpg2 | 2.4.4-150600.3.9.1 |
| SUSE Linux Micro 6.0 | gpg2 | 2.4.4-2.1 |
| SUSE Linux Micro 6.0 | gpg2 | 2.4.4-5.1 |
| SUSE Linux Micro 6.0 | gpg2 | 2.4.4-4.1 |
| SUSE Linux Micro 6.1 | gpg2 | 2.4.4-slfo.1.1_2.1 |
| SUSE Linux Micro 6.1 | gpg2 | 2.4.4-slfo.1.1_3.1 |
| SUSE Linux Micro 6.1 | gpg2 | 2.4.4-slfo.1.1_4.1 |
| SUSE Linux Micro 6.1 | gpg2 | 2.4.4-slfo.1.1_5.1 |
| Ubuntu 20.04 LTS | gnupg2 | 2.2.19-3ubuntu2.4 |
| Ubuntu 22.04 LTS | gnupg2 | 2.2.27-3ubuntu2.3 |
| Ubuntu 24.04 LTS | gnupg2 | 2.4.4-2ubuntu17.2 |
| Ubuntu 25.10 | gnupg2 | 2.4.4-2ubuntu23 |
| Ubuntu Pro 16.04 LTS | gnupg2 | 2.1.11-6ubuntu2.1+esm2 |
| Ubuntu Pro 18.04 LTS | gnupg2 | 2.2.4-1ubuntu1.6+esm1 |
| Wolfi | gnupg | 2.4.8-r1 |
| Wolfi | gnupg-dirmngr | 2.4.8-r1 |
| Wolfi | gnupg-doc | 2.4.8-r1 |
| Wolfi | gnupg-gpgconf | 2.4.8-r1 |
| Wolfi | gnupg-lang | 2.4.8-r1 |
| Wolfi | gnupg-scdaemon | 2.4.8-r1 |
| Wolfi | gnupg-utils | 2.4.8-r1 |
| Wolfi | gnupg-wks-client | 2.4.8-r1 |
| Wolfi | gpg | 2.4.8-r1 |
| Wolfi | gpg-agent | 2.4.8-r1 |
| Wolfi | gpg-wks-server | 2.4.8-r1 |
| Wolfi | gpgsm | 2.4.8-r1 |
| Wolfi | gpgv | 2.4.8-r1 |
| openSUSE Leap 15.6 | gpg2 | 2.4.4-150600.3.9.1 |
| openSUSE Tumbleweed | gpg2 | 2.5.6-1.1 |