OpenPGP 1.2.0 and earlier decrypts arbitrary messages

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-8013 · ADVISORY
• openpgpjs/openpgpjs commit 668a9bb · WEB
• openpgpjs/openpgpjs · PACKAGE
• openwall.com/lists/oss-security/2015/10/30/5 · WEB
• securityfocus.com/bid/77088 · Third Party Advisory

openpgpjs 的其他漏洞

• CVE-2023-41037中危 4.3OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographica…
• CVE-2019-9155中危 5.9A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptio…
• CVE-2019-9154高危 7.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
• CVE-2019-9153高危 7.5Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signat…