In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that     lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures     made from certain other signing keys, aka a 'verification DoS.'(CVE-2025-30258)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that     lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures     made from certain other signing keys, aka a 'verification DoS.'(CVE-2025-30258)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that     lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures     made from certain other signing keys, aka a verification DoS. (CVE-2025-30258)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1107 advisory.

    In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that     lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures     made from certain other signing keys, aka a verification DoS.

    Exploitation of this vulnerability requires the customer to manually import a crafted certificate     containing fingerprints that will then be used to verify signatures. Considering the tradeoff between the     stability of Amazon Linux and the exploitation complexity of CVE-2025-30258, a fix will not be provided     for gnupg2 in Amazon Linux 2 at this time. Users are advised to mitigate this issue by not importing     suspicious GPG certificates and deleting any malicious keys from their keyrings. (CVE-2025-30258)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02259-1 advisory.

    - CVE-2025-30258: Fixed DoS due to a malicious subkey in the keyring (bsc#1239119).

    Other bugfixes:

    - Do not install expired sks certificate (bsc#1243069).
    - gpg hangs when importing a key (bsc#1236931).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7412-1 advisory.

    It was discovered that GnuPG incorrectly handled importing keys with certain crafted subkey data. If a     user or automated system were tricked into importing a specially crafted key, a remote attacker may     prevent users from importing other keys in the future.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265131	EulerOS Virtualization 2.13.0 : gnupg2 (EulerOS-SA-2025-2163)	Nessus	Huawei Local Security Checks	low
265130	EulerOS Virtualization 2.13.1 : gnupg2 (EulerOS-SA-2025-2162)	Nessus	Huawei Local Security Checks	low
264451	EulerOS 2.0 SP10 : gnupg2 (EulerOS-SA-2025-2067)	Nessus	Huawei Local Security Checks	low
264423	EulerOS 2.0 SP12 : gnupg2 (EulerOS-SA-2025-2006)	Nessus	Huawei Local Security Checks	low
261893	EulerOS 2.0 SP10 : gnupg2 (EulerOS-SA-2025-2095)	Nessus	Huawei Local Security Checks	low
261869	EulerOS 2.0 SP12 : gnupg2 (EulerOS-SA-2025-2037)	Nessus	Huawei Local Security Checks	low
251944	Linux Distros Unpatched Vulnerability : CVE-2025-30258	Nessus	Misc.	low
249295	EulerOS 2.0 SP11 : gnupg2 (EulerOS-SA-2025-1926)	Nessus	Huawei Local Security Checks	low
249287	EulerOS 2.0 SP13 : gnupg2 (EulerOS-SA-2025-1989)	Nessus	Huawei Local Security Checks	low
249278	EulerOS 2.0 SP11 : gnupg2 (EulerOS-SA-2025-1952)	Nessus	Huawei Local Security Checks	low
249191	EulerOS 2.0 SP13 : gnupg2 (EulerOS-SA-2025-1975)	Nessus	Huawei Local Security Checks	low
243460	Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2025-1107)	Nessus	Amazon Linux Local Security Checks	low
241673	SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for gpg2 (SUSE-SU-2025:02259-1)	Nessus	SuSE Local Security Checks	low
233821	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GnuPG vulnerability (USN-7412-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2025-30258

medium

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

low

low