CVE-2019-9155 Invalid Curve Attack in openpgp
MediumCVSS 5.9
EPSS 1.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm openpgp(npm) | < 4.3.0 | 4.3.0 |
| openpgpjs | <= 4.2.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com release-notes
- sec-consult.com exploit third-party-advisory
- www.bsi.bund.de third-party-advisory
- snyk.io
- www.npmjs.com
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- github.com