pgpdump

pgpdump: a PGP packet visualizer Kazu Yamamoto [email protected] August 16, 2010 Overview pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991. Here is an example: % pgpdump test/sig1 Old: Marker Packettag 103 bytes String -...

CVE-2026-85243

CVE-2026-85243 — camel-crypto-pgp: integrity-verification downgrade legacy packet skips the check Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PGP data format's unmarshal verified the modification detection code only when the message used the OpenPGP...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

Critical: Red Hat Security Advisory: Satellite 6.16.15 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

PGP-client-checker-CVE-2021-33560

PGP client checker – CVE-2021-33560 This is a tool to check whether your OpenPGP client is affected by CVE-2021-33560. This vulnerability exposes to plaintext recovery the messages you encrypt to some ElGamal subkeys. The technical details of the vulnerability are described in this blog post and...

org.bouncycastle/bcpg-jdk18on: org.bouncycastle/bcpg-jdk15to18: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation

A flaw was found in Bouncy Castle. The high-level OpenPGP Pretty Good Privacy API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim's public signing key to an...

org.bouncycastle/bcpg-jdk18on: org.bouncycastle/bcpg-jdk15to18: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation

A flaw was found in Bouncy Castle. The high-level OpenPGP Pretty Good Privacy API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim's public signing key to an...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

Important: Red Hat Security Advisory: rust-rpm-sequoia security update

An update for rust-rpm-sequoia is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 10 : rust-rpm-sequoia (RHSA-2026:98248)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:98248 advisory. An implementation of the RPM PGP interface using Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via...

CVE-2026-85515

A flaw was found in Bouncy Castle. When processing truncated OpenPGP encrypted messages, the library incorrectly treats premature stream termination as a normal end of message and fails to perform required integrity checks. A remote attacker could exploit this flaw by tampering with or truncating...

CVE-2026-71887

A flaw was found in Bouncy Castle. The high-level OpenPGP Pretty Good Privacy API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim's public signing key to an...

rust-rpm-sequoia: rust-rpm-sequoia: Denial of Service via crafted RPM file during signature verification

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CLEANSTART-2024-ZQ38077 When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered t...

Security vulnerability affects the thunderbird package. When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...

CVE-2026-118174

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...