GitHub Advisoryadvisory · npm

GHSA-qmvq-f3fj-m3wg OpenPGP 1.2.0 and earlier decrypts arbitrary messages

HIGH Published 2022-05-17 Modified 2022-06-17 Official page ↗
Aliases
CVE-2015-8013
Ecosystem
npm
Packages
openpgp
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reviewed
2022-06-17

Affected packages

• npm openpgp: < 1.3.0 → fixed in 1.3.0

Description

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

Related

Alias · CVE (1)

  • CVE-2015-8013 s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass… vulnerability

References