CVE-2019-9155

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-9155
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9155.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-9155
Aliases
Published
2019-08-22T16:15:10.540Z
Modified
2026-04-10T04:20:44.813511Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

References

Affected packages

Git / github.com/openpgpjs/openpgpjs

Affected ranges

Type
GIT
Repo
https://github.com/openpgpjs/openpgpjs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6e20d7abdb25c9781c5c0e568faec35fa6bbea5
Fixed
d24bdd5fa21b501b2fd3defacab5af24c63dd322
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2.0"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.11.1
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.5
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.3.2
v3.*
v3.0.11
v3.0.12
v3.0.13
v3.0.4
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.1.1
v4.1.2
v4.2.0
v4.2.1
v4.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9155.json"