Description
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
References (6)
Core 6
Core References
Exploit, Third Party Advisory x_refsource_misc
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
Third Party Advisory x_refsource_misc
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
Release Notes x_refsource_confirm
https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0
Third Party Advisory x_refsource_confirm
https://github.com/openpgpjs/openpgpjs/pull/853
Patch, Third Party Advisory x_refsource_confirm
https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
Scores
CVSS v3
5.9
EPSS
0.0148
EPSS Percentile
70.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-327
Status
published
Products (2)
npm/openpgp
0 - 4.3.0npm
openpgpjs/openpgpjs
< 4.2.0
Published
Aug 22, 2019
Tracked Since
Feb 18, 2026