TI-2025-30327 CVE-2025-47934 · GHSA-8qff-qr5q-5pr8
OpenPGP.js's message signature verification can be spoofed
Priority MEDIUM 45
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol.
Vulnerabilities
6 records
TI-2023-21663 CVE-2023-41037 · GHSA-ch3c-v47x-4pgp
Cleartext Signed Message Signature Spoofing in openpgpjs
Priority LOW 20
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol.
TI-2019-06619 CVE-2019-9155 · GHSA-77jf-fjjf-xcww
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged…
Priority LOW 30
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gai…
TI-2019-06618 CVE-2019-9154 · GHSA-hfmf-q43v-2ffj
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an…
Priority LOW 36
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
TI-2019-06617 CVE-2019-9153 · GHSA-qwqc-28w3-fww6
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an…
Priority LOW 37
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
TI-2015-06663 CVE-2015-8013 · GHSA-qmvq-f3fj-m3wg
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted…
Priority LOW 39
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a…