PT-2025-47160 · Unknown · Gosign Desktop

Published 2025-11-17 · Updated 2026-02-05 · CVE-2025-65083

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoSign Desktop versions through 2.4.1

Description GoSign Desktop versions through 2.4.1 disable TLS certificate validation when configured to use a proxy server. This occurs if a user selects a proxy server without verifying that outbound HTTPS connections from the proxy server to internet servers succeed even for untrusted or invalid server certificates. In such a scenario, integrity protection could be bypassed. The issue arises outside the product’s intended use, where a client application is expected to trust an enterprise certificate authority and not set SSL VERIFY NONE. Placing the ~/.gosign directory in the home directory of an untrusted user and allowing other users to execute downloaded files is also considered unsafe.

Recommendations Versions prior to 2.4.1 are not affected. Versions through 2.4.1 should avoid using arbitrary proxy servers without verifying the validity of server certificates. Avoid placing the ~/.gosign directory in the home directory of an untrusted user. Avoid allowing other users to execute downloaded files.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-65083

ZDI-26-062

Affected Products

Gosign Desktop

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-65083 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-062 · Security Note
• https://twitter.com/CVEnew/status/1990455276110070202 · Twitter Post
• https://firma.infocert.it/prodotti/gosign · Note
• https://securityaffairs.com/184672/hacking/multiple-vulnerabilities-in-gosign-desktop-lead-to-remote-code-execution.html · Note
• https://t.me/CVEtracker/37504 · Telegram Post