TI-2025-30327 CVE-2025-47934 · GHSA-8qff-qr5q-5pr8
OpenPGP.js's message signature verification can be spoofed
Priority MEDIUM 45
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol.
openpgpjs
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
openpgpjs records in CISA KEVNo openpgpjs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2015-06663 CVE-2015-8013 · GHSA-qmvq-f3fj-m3wg
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted…
Priority LOW 39
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a…
TI-2019-06617 CVE-2019-9153 · GHSA-qwqc-28w3-fww6
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an…
Priority LOW 37
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
TI-2019-06618 CVE-2019-9154 · GHSA-hfmf-q43v-2ffj
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an…
Priority LOW 36
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
TI-2019-06619 CVE-2019-9155 · GHSA-77jf-fjjf-xcww
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged…
Priority LOW 30
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gai…
TI-2023-21663 CVE-2023-41037 · GHSA-ch3c-v47x-4pgp
Cleartext Signed Message Signature Spoofing in openpgpjs
Priority LOW 20
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol.