SB2019082306 - Multiple vulnerabilities in OpenPGP.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019082306

SB2019082306 - Multiple vulnerabilities in OpenPGP.js

Published: August 23, 2019

Security Bulletin ID SB2019082306
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2019-9153)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due the software does not verify the signature type during verification of a message signature. A remote attacker can send a specially crafted message with replaced signatures with a "standalone" or "timestamp" signature and  forge signed messages.


2) Improper Authentication (CVE-ID: CVE-2019-9154)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the unhashed subpackets are not cryptographically protected. A remote attacker can arbitrarily modify the contents of e.g. a key certification signature or revocation signature. As a result, the attacker can e.g. convince a victim to use an obsolete key for encryption.


3) Cryptographic issues (CVE-ID: CVE-2019-9155)

The vulnerability allows a remote attacker to extract the victim’s private key.

The vulnerability exists due to the implementation of the Elliptic Curve Diffie-Hellman (ECDH) key exchange algorithm does not verify that the communication partner’s public key is valid. A remote attacker can change an elliptic curve and calculate the victim’s resulting private key.

Remediation

Install update from vendor's website.

References