gnupg2 (2.4.9-8) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/debian/gnupg2.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/unstable
Path: debian/changelog
Repo size: 22736896
Browser: https://salsa.debian.org/debian/gnupg2
Last scan: 2026-10-16 10:15:03+00
Next scan: 2026-10-24 12:23:00+00
CI pipeline status: success

Debian changelog in Git:

gnupg2 (2.4.9-8) unstable; urgency=medium

  * Add upstream patchset for CVE-2026-105712
    gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data
    in an archive. When extracting an untrusted archive with --directory
    (aka -C) into an existing directory containing a pre-existing symlink,
    gpgtar can follow that symlink and create or overwrite a file outside
    the selected extraction directory. The write is limited by the
    extraction user's filesystem permissions. An archive extracted into a
    fresh empty directory does not have this risk.
    https://static.dev.gnupg.org/T8159.html (Closes: #1150168)

 -- Andreas Metzler <ametzler@debian.org>  Sat, 10 Oct 2026 15:36:45 +0200

This branch is even with tag debian/2.4.9-8