Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/idrsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
Recommended action: Upgrade to 256 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Recommended action: Upgrade to 76 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.