Hi,

The following vulnerability was published for gnupg2.

CVE-2026-105712[0]:
| gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted
| data in an archive. When extracting an untrusted archive with
| --directory (aka -C) into an existing directory containing a pre-
| existing symlink, gpgtar can follow that symlink and create or
| overwrite a file outside the selected extraction directory. The
| write is limited by the extraction user's filesystem permissions. An
| archive extracted into a fresh empty directory does not have this
| risk.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-105712
https://www.cve.org/CVERecord?id=CVE-2026-105712
[1] https://static.dev.gnupg.org/T8159.html
[2] https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html
[3] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
gnupg2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150168@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Metzler <ametzler@debian.org> (supplier of updated gnupg2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 10 Oct 2026 15:36:45 +0200
Source: gnupg2
Architecture: source
Version: 2.4.9-8
Distribution: unstable
Urgency: medium
Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Closes: 1150168
Changes:
 gnupg2 (2.4.9-8) unstable; urgency=medium
 .
   * Add upstream patchset for CVE-2026-105712
     gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data
     in an archive. When extracting an untrusted archive with --directory
     (aka -C) into an existing directory containing a pre-existing symlink,
     gpgtar can follow that symlink and create or overwrite a file outside
     the selected extraction directory. The write is limited by the
     extraction user's filesystem permissions. An archive extracted into a
     fresh empty directory does not have this risk.
https://static.dev.gnupg.org/T8159.html (Closes: #1150168)
Checksums-Sha1:
 eca456f7321804f6d7f9d5bd6b69d7528d268111 5459 gnupg2_2.4.9-8.dsc
 f9b45ee04e1e8ad20c82f4b1f249592440050c3b 110392 gnupg2_2.4.9-8.debian.tar.xz
Checksums-Sha256:
 aa955788f65d6f476642be6ee0c77084a093c0d6533fabb46afdb39c549a7219 5459 gnupg2_2.4.9-8.dsc
 69e954dc52f1a674bf567aa40064e24ca230210394975a6cddf98742e2a6f882 110392 gnupg2_2.4.9-8.debian.tar.xz
Files:
 4bef3973b08bb8eda8ba615cf64bf067 5459 utils optional gnupg2_2.4.9-8.dsc
 a233452166751126c7bbe2662b5f698d 110392 utils optional gnupg2_2.4.9-8.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmrKQhQACgkQpU8BhUOC
FITR6RAAiXb6g8L2Dg7seL/SbJnU/U/tuQKW60g6OOlEpZ4ugZeQvf3QOkUN+Vw1
rYJdIjfH38V0M+YHY03LHC3ouo5Fi86BEUqUjtswImeWNmg7Fjtyv7l7dWUuBdIF
QdCqXoPw5MAtwyvjULFNCu5Ohtar7RdCmL1j6wP1w9tJk/o/82vPoFhPSPX1O6OM
9oy1g8KTmlNbPk0VAGziku5nADFk/uAmUNAwnHKiCAuVN4EyKLiH7FBN1iUCFfbH
E7SLTGOkZz3YDEe99IVlsq+urmpvFxdT38aAsp6PZBRZ1pGQ72lrEV6EtmJm/dD2
t1WnVKSK5TpOpoop6HwMkAMo9uocqioYFyaFNk0XFruydledohqUbnTiVpVNtf2g
93HTYK5RsiF1mANgOMUu+Ofd+yvzgk83bFkDkUaQdcZk28HNu/6FeNwBZqCUQWF0
YGS4hJZ1SS+3FjkqP86DEBOvATi32NMOMXoYn1X97QjBzryUmp1dAGgdyNKxdOia
9NEZGq3PurhRvB5pNl/msJVeMooh9I+TQllzPxFbb9jywzdxZlx6R4i7LqwT8QeC
w5MkEWlPWTfjKLaI95NOtVWZ8k2utGE1SEfLDl1Jcs27YFyh8YQpisl8AfBE8+pB
GuDVaLFgI5DV1RiipDXtRMtEgu9T55rAXKvvuoUkBqW0U+jMu6g=
=NcXc
-----END PGP SIGNATURE-----

[...]

Good morning,

I suspect this is not worth a DSA?

cu Andreas

Hi Andreas,

Correct, we marked it as no-dsa and the update can go ideally into the
next trixie point release instread (if you have time for it!)

Thanks a lot for your work!

Rgards,
Salvatore