Description
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Recommendation
Update the openpgp package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.3.0
- Patched version(s): 1.3.0
References
Could your website be exposed too?
SmartScanner can check your website for OpenPGP 1.2.0 and earlier decrypts arbitrary messages and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691
- Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality - CVE-2021-32809
- Regular Expression Denial of Service in ansi2html - CVE-2015-9239
- @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023