Vulnerability · Published Aug 29, 2020 · Assigned by mitre
CVE-2020-24972
High 8.8
In plain English
A high-severity security flaw in the kleopatra package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)4.9%top 7.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kleopatra | 4:20.08.2-2 | DEBIAN-CVE-2020-24972 |
| Debian:13 | kleopatra | 4:20.08.2-2 | DEBIAN-CVE-2020-24972 |
| Debian:14 | kleopatra | 4:20.08.2-2 | DEBIAN-CVE-2020-24972 |
| Ubuntu:22.04:LTS | kleopatra | no fix listed | UBUNTU-CVE-2020-24972 |
| Ubuntu:24.04:LTS | kleopatra | no fix listed | UBUNTU-CVE-2020-24972 |
| Ubuntu:25.10 | kleopatra | no fix listed | UBUNTU-CVE-2020-24972 |
| Ubuntu:26.04:LTS | kleopatra | no fix listed | UBUNTU-CVE-2020-24972 |
| Ubuntu:26.10 | kleopatra | no fix listed | UBUNTU-CVE-2020-24972 |
Affected products (as reported)
References
- https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b x_refsource_MISC
- https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt x_refsource_MISC
- GLSA-202008-21 vendor-advisory, x_refsource_GENTOO
- FEDORA-2020-9b441d3153 vendor-advisory, x_refsource_FEDORA
- openSUSE-SU-2020:1723 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1754 vendor-advisory, x_refsource_SUSE