CVE-2019-9155 Invalid Curve Attack in openpgp

What is CVE-2019-9155?

CVE-2019-9155 is a medium-severity vulnerability in n/a, published on 22 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

Weakness: CWE-327

Which versions are affected by CVE-2019-9155?

2 open source packages ship an affected version, including openpgp. It affects 1 product.

Products include Openpgpjs Openpgpjs.

How do I fix CVE-2019-9155?

Upgrade openpgp to 4.3.0 or later.

Is CVE-2019-9155 being exploited?

There is no known exploitation of CVE-2019-9155 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-9153 Message Signature Bypass in openpgp High 7.5
• CVE-2019-9154 Improper Key Verification in openpgp High 7.5
• CVE-2015-8013 OpenPGP 1.2.0 and earlier decrypts arbitrary messages High 7.5
• CVE-2023-41037 Cleartext Signed Message Signature Spoofing in openpgpjs Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-77jf-fjjf-xcww.