Digital Signature Bypass

openpgp.js is vulnerable to digital signature bypass. The vulnerability exists through an improper verification of a cryptographic signature which allows adversaries to replace signatures with a standalone or timestamp signature...

ECDH Private Key Disclosure

openpgp.js is vulnerable to ECDH Private Key disclosure. The vulnerability exists due to an invalid curve attack resulted from allowing an attacker to forge messages to gain feedback on whether a decryption is successful...

CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

CVE-2019-9154

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9154

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

CVE-2019-9155

A cryptographic issue in OpenPGP.js =4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key...

Input validation

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

Design/Logic Flaw

A cryptographic issue in OpenPGP.js =4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key...

Input validation

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9155

CVE-2019-9155 affects OpenPGP.js up to version 4.2.0, where the ECDH implementation fails to validate the partner’s public key, enabling an attacker who can forge messages and observe decryption outcomes to perform an invalid-curve attack and potentially exfiltrate the victim’s ECDH private key. ...

CVE-2019-9155

A cryptographic issue in OpenPGP.js =4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key...

CVE-2019-9154

OpenPGP.js vulnerable versions:

CVE-2019-9154

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

Authentication flaw

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message...

CVE-2015-8013

CVE-2015-8013 concerns s2k.js in OpenPGP.js, where crafted PGP keys can be decrypted regardless of the provided passphrase, enabling an attacker to bypass authentication if message decryption is used as an authentication mechanism. The concrete technical detail across the connected documents iden...

Openpgp.js 's2k.js' Security Bypass Vulnerability

Openpgp.js is a library that implements the OpenPGP encryption algorithm in JavaScript. A security bypass vulnerability exists in Openpgp.js, which allows remote attackers to exploit the vulnerability to obtain sensitive information and perform unauthorized operations...