Description
OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools:
These messages typically contain a “Hash: …” header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the “Hash: …
Recommendation
Update the openpgp package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.10.1 < 4.10.11** Patched version(s): **5.10.1 4.10.11**
References
Could your website be exposed too?
SmartScanner can check your website for Cleartext Signed Message Signature Spoofing in openpgp and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OpenPGP.js's message signature verification can be spoofed - CVE-2025-47934
- Message Signature Bypass in openpgp - CVE-2019-9153
- RSA signature validation vulnerability on maleable encoded message in jsrsasign - CVE-2021-30246
- browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - CVE-2023-46234
You might also like:
See something that needs correcting? Let us knowUpdated November 06, 2023