OpenPGP 1.2.0 and earlier decrypts arbitrary messages

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-8013 · ADVISORY
• openpgpjs/openpgpjs commit 668a9bb · WEB
• openpgpjs/openpgpjs · PACKAGE
• openwall.com/lists/oss-security/2015/10/30/5 · WEB
• securityfocus.com/bid/77088 · Third Party Advisory

openpgpjs のその他の脆弱性

• CVE-2023-41037中 4.3OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographica…
• CVE-2019-9155中 5.9A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptio…
• CVE-2019-9154高 7.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
• CVE-2019-9153高 7.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signat…