Description
Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not verify whether a subpacket is hashed.
Recommendation
Update the openpgp package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.1.2
- Patched version(s): 4.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Improper Key Verification in openpgp and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Insufficient Verification of Data Authenticity in Eclipse Theia - CVE-2019-17636
- matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification - CVE-2022-39250
- Invalid Curve Attack in openpgp - CVE-2019-9155
- Improper Verification of Communication Channel in @theia/plugin-ext - CVE-2021-41038
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023