CVE-2025-8454

Uscan downloads upstream software sources and verifies their OpenPGP signatures to confirm authenticity. When a source has already been downloaded during a previous tool run, signature verification is skipped — regardless of whether the previous verification succeeded. This means that the locally stored file could be counterfeit or modified, and the tool will accept it without further checking. The bug is classified as CWE-347 (Improper Verification of Cryptographic Signature).

An attacker who can place a modified source file in the download location can cause a Debian package maintainer to unknowingly use forged source code — potentially leading to package takeover, introduction of malicious code into the distribution, or compromise of the software build environment.

Patches available from the vendor should be applied according to the references (https://bugs.debian.org/1109251). Until updates are available, it is recommended to manually remove locally downloaded source files before each uscan run to force re-download and signature verification.

Debian Devscripts — versions indicated in vendor references (uscan package); affects Debian package maintainers using the uscan tool