GHSA-c7ph-f7jm-xv4w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-c7ph-f7jm-xv4w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-c7ph-f7jm-xv4w/GHSA-c7ph-f7jm-xv4w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-c7ph-f7jm-xv4w
- Published
- 2026-02-13T20:55:20Z
- Modified
- 2026-02-22T23:23:41Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- rPGP's integrity protection of encrypted data was not always checked
- Details
-
Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.
Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.
Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.
Attribution
Discovered internally in the course of rPGP development work.
- Database specific
{ "cwe_ids": [ "CWE-354" ], "github_reviewed": true, "github_reviewed_at": "2026-02-13T20:55:20Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
crates.io / pgp
Package
- Name
- pgp
- View open source insights on deps.dev
- Purl
- pkg:cargo/pgp