What is GHSA-qmvq-f3fj-m3wg?

GHSA-qmvq-f3fj-m3wg is a security advisory published by GitHub Security Advisories with High severity. OpenPGP 1.2.0 and earlier decrypts arbitrary messages

Which CVE IDs does GHSA-qmvq-f3fj-m3wg cover?

GHSA-qmvq-f3fj-m3wg covers the following CVE IDs: CVE-2015-8013. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qmvq-f3fj-m3wg?

GHSA-qmvq-f3fj-m3wg has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qmvq-f3fj-m3wg?

GHSA-qmvq-f3fj-m3wg affects 1 product, including: npm/openpgp:\u003c 1.3.0.

GHSA-qmvq-f3fj-m3wgHighCVSS 7.5

OpenPGP 1.2.0 and earlier decrypts arbitrary messages

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2015-8013 →

📋 Description

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

🎯 Affected products1

npm/openpgp:< 1.3.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2015-8013
https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29
http://www.openwall.com/lists/oss-security/2015/10/30/5
https://github.com/advisories/GHSA-qmvq-f3fj-m3wg