A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged…
Priority LOW 30CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-327.
Summary
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
Why it matters now
EPSS 0.01709 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed openpgp (npm): 4.3.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | openpgp (npm) | before 4.3.0 | 4.3.0 | Patch available | GHSA-77jf-fjjf-xcww |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- openpgp (npm) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-77jf-fjjf-xcww
Remediation
- Fix · GHSA-77jf-fjjf-xcww openpgp (npm) Fixed in 4.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9155
- 2026-10-03 Alias added: GHSA-77jf-fjjf-xcww
References
Patch 1
Advisory 4
- https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
- https://github.com/openpgpjs/openpgpjs/pull/853
- http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-9155
More Openpgpjs vulnerabilities
- TI-2015-06663 s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted… CVSS 3.0HIGH 7.5
- TI-2019-06617 Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an… CVSS 3.0HIGH 7.5
- TI-2019-06618 Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an… CVSS 3.0HIGH 7.5
- TI-2023-21663 Cleartext Signed Message Signature Spoofing in openpgpjs CVSS 3.1MEDIUM 4.3
Sources
- CVE-2019-9155 · CVE Program
- CVE-2019-9155 · NVD
- FIRST EPSS
- GHSA-77jf-fjjf-xcww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences