CVE-2025-30258: gnupg
CVSS: 4.7v3.1MediumAnalyzed
AliasesMGASA-2025-0133SUSE-RU-2025:20460-1SUSE-SU-2025:02259-1SUSE-SU-2025:20209-1SUSE-SU-2025:20444-1SUSE-SU-2025:20454-1SUSE-SU-2025:20458-1SUSE-SU-2025:20465-1SUSE-SU-2025:20472-1SUSE-SU-2025:3986-1UBUNTU-CVE-2025-30258USN-7412-1DEBIAN-CVE-2025-30258CGA-2p76-pv2g-wc8cCGA-455p-v9fr-mg95CGA-46fj-8q46-6cqvCGA-4pvw-88qm-5x55CGA-56rj-gqm8-gf55CGA-57rp-9ccr-x64gCGA-6vff-h9qp-jwp7CGA-72cq-ch62-9m59CGA-7746-9hr4-2h7fCGA-7rww-hmrm-fxv5CGA-92g6-x26g-8x6qCGA-9mf4-2c4g-5c2hCGA-c9hc-2fqw-rfgcCGA-f6hc-4w2j-qj5jCGA-gfvm-v29h-c8f8CGA-gh6v-8jvm-gx99CGA-jqqq-fr37-5wcqCGA-m595-hffq-x4r5CGA-mrpg-mj4c-qwc4CGA-pmc4-3qhq-3gr3CGA-qf8m-xpq7-58mjCGA-qr4r-8m47-hqc7CGA-r8rx-3658-q35cCGA-rcwc-6hfm-56rvCGA-w3h7-4x55-x52cCGA-w5gh-mx93-gr55openSUSE-SU-2025:15076-1
Published 19-03-2025Last modified 19-03-2025
Vulnerability summary
CVE-2025-30258 is a medium (CVSS 4.7) vulnerability in gnupg. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
4.7/10
010
Medium · v3.1 (NVD)EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 19-03-2025PublishedVulnerability first disclosed.
- 19-03-2025Last modifiedVulnerability information updated.
Description
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
CVSS metrics
6 scores · 6 sources · 1 versionMedium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HSources6 sources · 2.7–4.7
- CVE.orgCNA2.7LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 19-09-2026
19-09-202619-10-2026
EPSS score0.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (dev.gnupg.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- gnupg< 2.4.8-r1
- gnupg-dirmngr< 2.4.8-r1
- gnupg-doc< 2.4.8-r1
- gnupg-gpgconf< 2.4.8-r1
- gnupg-lang< 2.4.8-r1
Wolfi13 products
- gnupg< 2.4.8-r1
- gnupg-dirmngr< 2.4.8-r1
- gnupg-doc< 2.4.8-r1
- gnupg-gpgconf< 2.4.8-r1
- gnupg-lang< 2.4.8-r1
Suse8 products
- gpg2&distro=SUSE Linux Enterprise Micro 5.2< 2.2.27-150300.3.13.1
- gpg2&distro=SUSE Linux Enterprise Micro 5.3< 2.2.27-150300.3.13.1
- gpg2&distro=SUSE Linux Enterprise Micro 5.4< 2.2.27-150300.3.13.1
- gpg2&distro=SUSE Linux Enterprise Micro 5.5< 2.2.27-150300.3.13.1
- gpg2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6< 2.4.4-150600.3.9.1
Opensuse2 products
- gpg2&distro=openSUSE Leap 15.6< 2.4.4-150600.3.9.1
- gpg2&distro=openSUSE Tumbleweed< 2.5.6-1.1
Debian1 product
- gnupg2All versions (No fix recorded) | < 2.2.46-5
Gnupg1 product
- gnupg< 2.5.5 | < 2.4.8 | ≥ 2.5.0, < 2.5.5
Mageia1 product
- gnupg2< 2.3.8-1.3.mga9
Ubuntu1 product
- gnupg2< 2.1.11-6ubuntu2.1+esm2 | < 2.2.4-1ubuntu1.6+esm1 | < 2.4.4-2ubuntu23 | < 2.2.19-3ubuntu2.4 | < 2.2.27-3ubuntu2.3 | < 2.4.4-2ubuntu17.2
8 vendors · 40 products
References
26 links- lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.htmlREPORTAdvisoryMailing ListRelease NotesVendor Advisory
Show all 26 references
- lists.opensuse.org/archives/…Advisory
