{"id":"CLSA-2026-1776159098","summary":"Fix CVE(s): CVE-2025-30258","details":"   * SECURITY UPDATE: signature verification DoS via malicious subkey\n     - debian/patches/CVE-2025-30258.patch: require signing usage when\n       looking up public key for signature verification, filtering out\n       subkeys without valid backsig. Include upstream regression fixes\n       to preserve verification of signatures from expired/revoked keys.\n       Widen pubkey_usage and req_usage fields from byte to u16 to\n       prevent PUBKEY_USAGE_VERIFY (16384) from being truncated on\n       GnuPG 2.2.x. Add primary-key-only lookup during import to\n       prevent malicious subkey attack at import time. Fix double-free\n       in check_signature_over_key_or_uid when signer is caller-owned.\n     - CVE-2025-30258","modified":"2026-06-04T09:45:18.467178134Z","published":"2026-04-14T09:31:43Z","upstream":["CVE-2025-30258"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1776159098.html"}],"affected":[{"package":{"name":"dirmngr","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/dirmngr?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gnupg","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gnupg?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gnupg-agent","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gnupg-agent?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gnupg-l10n","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gnupg-l10n?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gnupg-utils","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gnupg-utils?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gnupg2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gnupg2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpg","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpg?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpg-agent","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpg-agent?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpg-wks-client","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpg-wks-client?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpg-wks-server","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpg-wks-server?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgconf","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgconf?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgsm","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgsm?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgv","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgv?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgv-static","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgv-static?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgv-win32","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgv-win32?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"gpgv2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/gpgv2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}},{"package":{"name":"scdaemon","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/scdaemon?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1776159098.json"}}],"schema_version":"1.7.5"}