Authentication Bypass

2017-07-2521:39:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

65.1%

JSON

OpenPGP is vulnerable to authentication bypass. s2k.js will decrypt messages regardless of the passphrase given. If message decryption is used as an authentication mechanism, attackers can use this flaw to bypass the authentication.

CPENameOperatorVersion
openpgple1.2.0
opengpgle1.2.0
openpgple1.2.0

Name	Operator	Version
openpgp	le	1.2.0
opengpg	le	1.2.0
openpgp	le	1.2.0

References

seclists.org/oss-sec/2015/q4/77

0.002 Low

EPSS

Percentile

65.1%

JSON

Related for VERACODE:4671