Vulnerabilities > CVE-2019-9155 - Cryptographic Issues vulnerability in Openpgpjs

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

openpgpjs

CWE-310

NVD

Published: 2019-08-22

Updated: 2021-07-21

Summary

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

Vulnerable Configurations

Part	Description	Count
Application	Openpgpjs Openpgpjs Openpgpjs 0.1.0 Openpgpjs Openpgpjs 0.2.0 Openpgpjs Openpgpjs 0.2.1 Openpgpjs Openpgpjs 0.3.0 Openpgpjs Openpgpjs 0.3.1 Openpgpjs Openpgpjs 0.3.2 Openpgpjs Openpgpjs 0.4.0 Openpgpjs Openpgpjs 0.4.1 Openpgpjs Openpgpjs 0.5.0 Openpgpjs Openpgpjs 0.5.1 Openpgpjs Openpgpjs 0.6.0 Openpgpjs Openpgpjs 0.6.1 Openpgpjs Openpgpjs 0.6.2 Openpgpjs Openpgpjs 0.6.3 Openpgpjs Openpgpjs 0.6.5 Openpgpjs Openpgpjs 0.7.0 Openpgpjs Openpgpjs 0.7.1 Openpgpjs Openpgpjs 0.7.2 Openpgpjs Openpgpjs 0.8.0 Openpgpjs Openpgpjs 0.8.1 Openpgpjs Openpgpjs 0.8.2 Openpgpjs Openpgpjs 0.9.0 Openpgpjs Openpgpjs 0.10.0 Openpgpjs Openpgpjs 0.10.1 Openpgpjs Openpgpjs 0.10.2 Openpgpjs Openpgpjs 0.10.3 Openpgpjs Openpgpjs 0.11.0 Openpgpjs Openpgpjs 0.11.1 Openpgpjs Openpgpjs 1.0.0 Openpgpjs Openpgpjs 1.0.1 Openpgpjs Openpgpjs 1.1.0 Openpgpjs Openpgpjs 1.2.0 Openpgpjs Openpgpjs 1.3.0 Openpgpjs Openpgpjs 1.4.0 Openpgpjs Openpgpjs 1.4.1 Openpgpjs Openpgpjs 1.5.0 Openpgpjs Openpgpjs 1.5.1 Openpgpjs Openpgpjs 1.5.2 Openpgpjs Openpgpjs 1.5.3 Openpgpjs Openpgpjs 1.5.4 Openpgpjs Openpgpjs 1.5.5 Openpgpjs Openpgpjs 1.5.6 Openpgpjs Openpgpjs 1.5.7 Openpgpjs Openpgpjs 1.6.0 Openpgpjs Openpgpjs 1.6.1 Openpgpjs Openpgpjs 1.6.2 Openpgpjs Openpgpjs 2.0.0 Openpgpjs Openpgpjs 2.0.1 Openpgpjs Openpgpjs 2.1.0 Openpgpjs Openpgpjs 2.2.0 Openpgpjs Openpgpjs 2.2.1 Openpgpjs Openpgpjs 2.2.2 Openpgpjs Openpgpjs 2.3.0 Openpgpjs Openpgpjs 2.3.1 Openpgpjs Openpgpjs 2.3.2 Openpgpjs Openpgpjs 2.3.3 Openpgpjs Openpgpjs 2.3.4 Openpgpjs Openpgpjs 2.3.5 Openpgpjs Openpgpjs 2.3.6 Openpgpjs Openpgpjs 2.3.7 Openpgpjs Openpgpjs 2.3.8 Openpgpjs Openpgpjs 2.4.0 Openpgpjs Openpgpjs 2.5.0 Openpgpjs Openpgpjs 2.5.1 Openpgpjs Openpgpjs 2.5.2 Openpgpjs Openpgpjs 2.5.3 Openpgpjs Openpgpjs 2.5.4 Openpgpjs Openpgpjs 2.5.5 Openpgpjs Openpgpjs 2.5.6 Openpgpjs Openpgpjs 2.5.7 Openpgpjs Openpgpjs 2.5.8 Openpgpjs Openpgpjs 2.5.9 Openpgpjs Openpgpjs 2.5.10 Openpgpjs Openpgpjs 2.5.11 Openpgpjs Openpgpjs 2.5.12 Openpgpjs Openpgpjs 2.5.13 Openpgpjs Openpgpjs 2.5.14 Openpgpjs Openpgpjs 2.6.0 Openpgpjs Openpgpjs 2.6.1 Openpgpjs Openpgpjs 2.6.2 Openpgpjs Openpgpjs 3.0.0 Openpgpjs Openpgpjs 3.0.1 Openpgpjs Openpgpjs 3.0.2 Openpgpjs Openpgpjs 3.0.3 Openpgpjs Openpgpjs 3.0.4 Openpgpjs Openpgpjs 3.0.6 Openpgpjs Openpgpjs 3.0.7 Openpgpjs Openpgpjs 3.0.8 Openpgpjs Openpgpjs 3.0.9 Openpgpjs Openpgpjs 3.0.10 Openpgpjs Openpgpjs 3.0.11 Openpgpjs Openpgpjs 3.0.12 Openpgpjs Openpgpjs 3.0.13 Openpgpjs Openpgpjs 3.1.0 Openpgpjs Openpgpjs 3.1.1 Openpgpjs Openpgpjs 3.1.2 Openpgpjs Openpgpjs 3.1.3 Openpgpjs Openpgpjs 4.0.0 Openpgpjs Openpgpjs 4.0.1 Openpgpjs Openpgpjs 4.0.2 Openpgpjs Openpgpjs 4.1.0 Openpgpjs Openpgpjs 4.1.1 Openpgpjs Openpgpjs 4.1.2 Openpgpjs Openpgpjs 4.2.0	104

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References