Vulnerability Description
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openpgpjs | Openpgpjs | <= 4.2.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-InThird Party AdvisoryVDB Entry
- https://github.com/openpgpjs/openpgpjs/pull/853Third Party Advisory
- https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d733PatchThird Party Advisory
- https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0Release Notes
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-jExploitThird Party Advisory
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/MailvelThird Party Advisory
- http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-InThird Party AdvisoryVDB Entry
- https://github.com/openpgpjs/openpgpjs/pull/853Third Party Advisory
- https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d733PatchThird Party Advisory
- https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0Release Notes
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-jExploitThird Party Advisory
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/MailvelThird Party Advisory
FAQ
What is CVE-2019-9155?
CVE-2019-9155 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve at...
How severe is CVE-2019-9155?
CVE-2019-9155 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9155?
Check the references section above for vendor advisories and patch information. Affected products include: Openpgpjs Openpgpjs.