CVE-2020-24972: fedoraproject fedora Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2020-24972 is a high (CVSS 8.8) Improper Encoding or Escaping of Output vulnerability in fedoraproject fedora. EPSS estimates a 4.85% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.85%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+0.09 pp
From 4.76% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (dev.gnupg.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Opensuse3 products
- backports_sle15.0:sp1
- leapEOL15.1
- kleopatra&distro=openSUSE Leap 15.1< 18.12.3-lp151.2.4.1
Debian1 product
- kleopatra< 4:20.08.2-2
Fedoraproject1 product
- fedoraEOL32
Kleopatra_project1 product
- kleopatra< 20.07.80
Mageia1 product
- kleopatra< 19.04.0-1.1.mga7
Suse1 product
- kleopatra&distro=SUSE Package Hub 15 SP1< 18.12.3-bp151.3.3.1
Ubuntu1 product
- kleopatraAll versions (No fix recorded)
7 vendors · 9 products
References
16 links- dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54bX Refsource MISCREPORTPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/archives/…Advisory
Show all 16 references
- lists.opensuse.org/archives/…Advisory