RSS   Vulnerabilities for 'Openpgpjs'   RSS

2019-08-22
 
CVE-2019-9155

CWE-310
 

 
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

 
 
CVE-2019-9154

CWE-347
 

 
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.

 
 
CVE-2019-9153

CWE-347
 

 
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

 
2017-07-25
 
CVE-2015-8013

 

 
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

 


Copyright 2024, cxsecurity.com

 

Back to Top