[pkg-gnupg-maint] Bug#1150168: gnupg2: CVE-2026-105712

[Salvatore Bonaccorso]

Hi Andreas,

On Sun, Oct 11, 2026 at 07:33:44AM +0200, Andreas Metzler wrote:
> On 2026-10-06 Salvatore Bonaccorso <carnil at debian.org> wrote:
> > Source: gnupg2
> > Version: 2.4.9-7
> > X-Debbugs-CC: team at security.debian.org
> > Severity: important
> > Tags: security upstream
> 
> > Hi,
> 
> > The following vulnerability was published for gnupg2.
> 
> > CVE-2026-105712[0]:
> > | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted
> > | data in an archive. When extracting an untrusted archive with
> > | --directory (aka -C) into an existing directory containing a pre-
> > | existing symlink, gpgtar can follow that symlink and create or
> > | overwrite a file outside the selected extraction directory. The
> > | write is limited by the extraction user's filesystem permissions. An
> > | archive extracted into a fresh empty directory does not have this
> > | risk.
> 
> 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> [...]
> 
> Good morning,
> 
> I suspect this is not worth a DSA?

Correct, we marked it as no-dsa and the update can go ideally into the
next trixie point release instread (if you have time for it!)

Thanks a lot for your work!

Rgards,
Salvatore