openpgp
npm6 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting openpgppage 1 of 1
- CVE-2015-8013HIGHCVSS 7.5EG 7.5✓ Fixed in 1.3.02017-07-25
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrica…
- CVE-2019-9153HIGHCVSS 7.5EG 7.5✓ Fixed in 4.2.02019-08-22
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
- CVE-2019-9154HIGHCVSS 7.5EG 7.5✓ Fixed in 4.2.02019-08-22
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
- CVE-2019-9155MEDIUMCVSS 5.9EG 5.9✓ Fixed in 4.3.02019-08-22
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH…
- CVE-2023-41037MEDIUMCVSS 4.3EG 4.3✓ Fixed in 5.10.12023-08-29
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typical…
- CVE-2025-47934HIGHCVSS 8.7EG 0.0✓ Fixed in 6.1.12025-05-19
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing thes…
Check whether openpgp is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for openpgp CVEs against the assets you own.
Start Free Scan →