CVE-2015-8013

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2017-07-25

Last modified

2024-08-06

Weaknesses

CWE-310

Affected products

• Openpgpjs (Openpgpjs)

References

• http://www.openwall.com/lists/oss-security/2015/10/30/5
• http://www.securityfocus.com/bid/77088
• https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29