CVE-2025-8454

The uscan tool, which is part of the devscripts package used by Debian package maintainers, contains a security vulnerability where it skips OpenPGP verification for upstream software releases. If a source was previously downloaded during an earlier run, the tool fails to re-verify the signature ...