CVE-2019-9155

Опубликовано: 22 авг. 2019

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

Ссылки

http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
Third Party Advisory
VDB Entry
https://github.com/openpgpjs/openpgpjs/pull/853
Third Party Advisory
https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
Patch
Third Party Advisory
https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0
Release Notes
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
Exploit
Third Party Advisory
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
Third Party Advisory
http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
Third Party Advisory
VDB Entry
https://github.com/openpgpjs/openpgpjs/pull/853
Third Party Advisory
https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
Patch
Third Party Advisory
https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0
Release Notes
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
Exploit
Third Party Advisory
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openpgpjs:openpgpjs:*:*:*:*:*:*:*:*

Версия до 4.2.0 (включая)

EPSS

Процентиль: 54%

0.00309

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-327

Связанные уязвимости

CVE-2019-9155

CVSS3: 5.9

debian

больше 6 лет назад

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is ...

GHSA-77jf-fjjf-xcww

CVSS3: 5.9

github

больше 6 лет назад

Invalid Curve Attack in openpgp

EPSS

Процентиль: 54%

0.00309

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-327