4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
0.0005 Low
EPSS
Percentile
17.1%
openpgp is vulnerable to PGP Signature Spoofing. The vulnerability exists due to ignoring text before the hash: ...
section. An attacker can append text to the start of of the line, which will appear as signed but the library ignores verifying it.