PatchTheCVECVE-2015-8013: s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allow
CVE-2015-8013 is a high-severity flaw (CVSS 7.5) affecting openpgpjs. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Why this priority
- High severity
- EPSS top 10%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.9% (top 10%) |
| CISA exploited list | No |
| Weakness | CWE-310 |
| Published | 2017-07-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-8013?
openpgpjs: upgrade to newer than 1.2.0. Exact commands for each OS are on this page.
Is CVE-2015-8013 being exploited?
CVE-2015-8013 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-8013 affect?
CVE-2015-8013 affects openpgpjs. Severity is high (CVSS 7.5). s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrical
How urgent is CVE-2015-8013?
Priority 54/100. High severity; EPSS top 10%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2019-9155 MEDIUM 5.9 UPGRADE A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain fe
- CVE-2019-9154 HIGH 7.5 UPGRADE Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsign
- CVE-2019-9153 HIGH 7.5 UPGRADE Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed me