vcswatch reports that
this package seems to have a new changelog entry (version
2.4.8-4, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
1 issue left for the package maintainer to handle:
CVE-2025-30258:
(needs triaging)
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
debian/patches: 39 patches to forward upstream
low
Among the 45 debian patches
available in version 2.4.8-3 of the package,
we noticed the following issues:
39 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/gnupg2.png){kind=link}