CVE-2025-8454

Name	CVE-2025-8454
Description	It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1109251

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
devscripts (PTS)	bullseye	2.21.3+deb11u1	vulnerable
	bookworm	2.23.4+deb12u2	vulnerable
	trixie	2.25.15+deb13u1	vulnerable
	forky, sid	2.25.19	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
devscripts	source	(unstable)	(unfixed)			1109251

Notes

[trixie] - devscripts <no-dsa> (Can be fixed via a point release)
[bookworm] - devscripts <no-dsa> (Can be fixed via a point release)
[bullseye] - devscripts <postponed> (Minor issue)