CVE-2019-9153 Message Signature Bypass in openpgp

Q: Which versions are affected by CVE-2019-9153?

2 open source packages ship an affected version, including openpgp. It affects 1 product.

Q: Is CVE-2019-9153 being exploited?

There is no known exploitation of CVE-2019-9153 in the wild and no public exploit code.

Q: How do I fix CVE-2019-9153?

Upgrade openpgp to 4.2.0 or later.

High 7.5 Published 22 Aug 2019 Updated 4 Aug 2024

Attackers can forge signed messages in OpenPGP.js by replacing signatures, compromising message integrity and authenticity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-9153?

CVE-2019-9153 is a high-severity vulnerability in n/a, published on 22 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

Weakness: CWE-347

Which versions are affected by CVE-2019-9153?

2 open source packages ship an affected version, including openpgp. It affects 1 product.

Package	Affected	Fixed in
`openpgp` npm	All versions	`4.2.0`
`openpgp` npm	All versions	`4.2.0`

Products include Openpgpjs Openpgpjs.

How do I fix CVE-2019-9153?

Upgrade openpgp to 4.2.0 or later.

Is CVE-2019-9153 being exploited?

There is no known exploitation of CVE-2019-9153 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-qwqc-28w3-fww6.