5.9med
CVE-2019-9155
Invalid Curve Attack in openpgp
Also known as GHSA-77jf-fjjf-xcww
Published 7 y ago · modified 4 mo ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known
Summary
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
Exploit prediction (EPSS)
1.71% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openpgp | <4.3.0 | 4.3.0 |
Classification
- Weakness
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
- sec-consult.com /en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/ · x_refsource_MISC, x_transferred
- bsi.bund.de /SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensi · x_refsource_MISC, x_transferred
- github.com /openpgpjs/openpgpjs/releases/tag/v4.3.0 · x_refsource_CONFIRM, x_transferred
- github.com /openpgpjs/openpgpjs/pull/853 · x_refsource_CONFIRM, x_transferred
- github.com /openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e · x_refsource_CONFIRM, x_transferred
- packetstormsecurity.com /files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2019-9155 · advisory
- sec-consult.com /en/blog/advisories/multiple-vulnerabilities-in-openpgp-js · web
- snyk.io /vuln/SNYK-JS-OPENPGP-460225 · web
- npmjs.com /advisories/1159 · web
Sources
- CVE List: CVE-2019-9155
- GitHub Advisory: GHSA-77jf-fjjf-xcww
- NVD: CVE-2019-9155
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.