#VU20372 Improper Authentication in OpenPGP.js - CVE-2019-9154

Vulnerability identifier: #VU20372

Vulnerability risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-9154

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OpenPGP.js
Universal components / Libraries / Libraries used by multiple products

Vendor: ProtonMail

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the unhashed subpackets are not cryptographically protected. A remote attacker can arbitrarily modify the contents of e.g. a key certification signature or revocation signature. As a result, the attacker can e.g. convince a victim to use an obsolete key for encryption.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenPGP.js: 0.1.0 - 4.2.0

---

External links
https://github.com/openpgpjs/openpgpjs/pull/797
https://github.com/openpgpjs/openpgpjs/pull/797/commits/47138eed61473e13ee8f05931119d3e10542c5e1
https://github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.