CVE-2025-34324
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching hash, causing the client to download and install a tampered update and resulting in arbitrary code execution.
Risk Assessment
An attacker could execute arbitrary code with the privileges of the GoSign Desktop user or with elevated privileges on some Linux deployments. A local attacker could also abuse this to escalate privileges by forcing installation of a crafted update.
Recommendation
Update GoSign Desktop to a version later than 2.4.0, which contains the fix, and do not disable TLS certificate validation and restrict the ability to modify proxy settings.
Other vulnerabilities in GoSign Desktop
Original NVD description (English source)
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching hash. This can cause the client to download and install a tampered update, resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on some Linux deployments. A local attacker who can modify proxy settings may also abuse this behavior to escalate privileges by forcing installation of a crafted update.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS