GHSA-QWQC-28W3-FWW6 Message Signature Bypass in openpgp

🗓️ 23 Aug 2019 21:42:20Reported by GoogleType

osv🔗 osv.dev👁 16 Views

Message Signature Bypass in openpgp version prior to 4.2.0 are vulnerable to message signature bypass. Fails to verify signature type allowing attacker to construct arbitrary signed messages. Upgrade to version 4.2.0 or later

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2019-9153	22 Aug 201915:30	–	cve
Cvelist	CVE-2019-9153	22 Aug 201915:30	–	cvelist
EUVD	EUVD-2019-0640	7 Oct 202500:30	–	euvd
Github Security Blog	Message Signature Bypass in openpgp	23 Aug 201921:42	–	github
nodejs	Message Signature Bypass	6 Sep 201919:50	–	nodejs
NVD	CVE-2019-9153	22 Aug 201916:15	–	nvd
Prion	Input validation	22 Aug 201916:15	–	prion
Veracode	Digital Signature Bypass	23 Aug 201901:50	–	veracode

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-9153
github	www.github.com/openpgpjs/openpgpjs/pull/797/commits/327d3e5392a6f59a4270569d200c7f7a2bfc4cbc
github	www.github.com/openpgpjs/openpgpjs/pull/816
github	www.github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0
sec-consult	www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js
snyk	www.snyk.io/vuln/SNYK-JS-OPENPGP-460248
bsi	www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
npmjs	www.npmjs.com/advisories/1160
packetstormsecurity	www.packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html

08 Nov 2023 04:01Current

7.4High risk

Vulners AI Score7.4

CVSS 37.5

EPSS0.02013