CVE-2023-41037

creationtimestamp| type| source ---|---|--- 2023-08-29 20:17:35+00:00| seen| https://t.me/cibsecurity/69360...

@aloe2/abstract-eth (1.0.20228282226), @aloe2/abstract-utxo (1.1.20228282226) +179 more potentially affected by CVE-2023-41037 via openpgp (>=5.0.0, <=5.9.0)

openpgp NPM version =5.0.0, =5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on openpgp and may be impacted: - @aloe2/abstract-eth 1.0.20228282226 - @aloe2/abstract-utxo 1.1.20228282226 - @aloe2/account-lib 2.20.20228282226 - @aloe2/bitgo...

@blinkhealth/config-yourself (>=1.0.0, <=1.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +18 more potentially affected by CVE-2023-41037 via openpgp (>=4.5.1, <=4.10.10)

openpgp NPM version =4.5.1, =1.0.0, =1.30.3, =9.0.0-dev.5644f38, =0.0.1, =1.1.6, =0.0.1, =2.0.0, =0.3.4, =0.9.0, =1.25.0, =1.31.0 and more Source cves: CVE-2023-41037 Source advisory: OSV:GHSA-CH3C-V47X-4PGP...

CVE-2023-41037

OpenPGP.js vulnerability (CVE-2023-41037) in Cleartext Signed Messages: versions up to 5.9.0 ignore data before the Hash: header, enabling text insertion that appears signed. Impact arises if an app verifies only verificationResult.verified and visually trusts the message; otherwise, verified dat...