CVE-2019-9155
First published: Thu Aug 22 2019(Updated: )
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openpetra | <=4.2.0 |
Remedy
https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
- https://github.com/openpgpjs/openpgpjs/pull/853
- https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
- https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0
- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
Frequently Asked Questions
What is the severity of CVE-2019-9155?
CVE-2019-9155 is classified as a high-severity vulnerability due to its potential to compromise the ECDH private key of victims.
How do I fix CVE-2019-9155?
To mitigate CVE-2019-9155, you should upgrade to OpenPGP.js version 4.2.1 or later.
What type of attack does CVE-2019-9155 enable?
CVE-2019-9155 enables an invalid curve attack, allowing attackers to potentially recover the ECDH private key.
Who is affected by CVE-2019-9155?
CVE-2019-9155 affects all users of OpenPGP.js versions 4.2.0 and earlier.
What is the impact of CVE-2019-9155 on data security?
The impact of CVE-2019-9155 is significant as it may lead to unauthorized access to encrypted communications by extracting private keys.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openpgpjs
- canonical/openpetra
- version/openpetra/4.2.0