PatchTheCVEopenpgpjs vulnerabilities and fixes
Recent CVEs affecting openpgpjs, with upgrade or downgrade steps. 4 tracked.
openpgpjs has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2019-08-22. Highest priority: CVE-2019-9153 (score 56/100).
- CVE-2019-9155 MEDIUM 5.9 UPGRADE A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain fe
- CVE-2019-9154 HIGH 7.5 UPGRADE Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsign
- CVE-2019-9153 HIGH 7.5 UPGRADE Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed me
- CVE-2015-8013 HIGH 7.5 UPGRADE s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allow
FAQ
How do I fix openpgpjs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openpgpjs being exploited right now?
None of the tracked openpgpjs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openpgpjs CVE should I patch first?
CVE-2019-9153 currently ranks highest (56/100): Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed me.