{"action":"Upgrade kleopatra to 4:20.08.2-2 or later.","affected":[{"fixed":"4:20.08.2-2","introduced":"0"}],"component":"kleopatra","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["4:20.08.2-2"],"id":"tcs_01M5NEVBCQJCWE84HJKB9YRB52","modified_at":"2026-10-26T12:01:46.728823513Z","published_at":"2020-08-29T21:15:11.330Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-24972","https://security-tracker.debian.org/tracker/CVE-2020-24972"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-24972#Debian:13/kleopatra","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-24972"}],"summary":"The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line op"}