CVE-2015-8013 OpenPGP 1.2.0 and earlier decrypts arbitrary messages
Attackers can bypass authentication in OpenPGP.js by crafting PGP keys that allow decryption of arbitrary messages without the correct passphrase.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8013?
CVE-2015-8013 is a high-severity vulnerability in n/a, published on 25 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Weakness: CWE-310
Which versions are affected by CVE-2015-8013?
2 open source packages ship an affected version, including openpgp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openpgp npm | All versions | 1.3.0 |
openpgp npm | All versions | 1.3.0 |
Products include Openpgpjs Openpgpjs.
How do I fix CVE-2015-8013?
Upgrade openpgp to 1.3.0 or later.
Is CVE-2015-8013 being exploited?
There is no known exploitation of CVE-2015-8013 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qmvq-f3fj-m3wg.