GHSA-qmvq-f3fj-m3wg

Source

https://github.com/advisories/GHSA-qmvq-f3fj-m3wg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmvq-f3fj-m3wg/GHSA-qmvq-f3fj-m3wg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qmvq-f3fj-m3wg

Aliases

CVE-2015-8013

Published

2022-05-17T02:15:35Z

Modified

2023-11-08T03:58:01Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OpenPGP 1.2.0 and earlier decrypts arbitrary messages

Details

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-17T21:22:31Z",
    "nvd_published_at":  "2017-07-25T18:29:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / openpgp

Package

Name: openpgp; View open source insights on deps.dev
Purl: pkg:npm/openpgp

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qmvq-f3fj-m3wg/GHSA-qmvq-f3fj-m3wg.json"