PT-2019-19399 · Openpgp · Openpgp.Js
Wolfgang Ettlinger
·
Publicado
2019-08-22
·
Atualizado
2021-07-21
·
CVE-2019-9155
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenPGP.js versions prior to 4.3.0
Description
A cryptographic issue allows an attacker to conduct an invalid curve attack, potentially gaining the victim's ECDH private key. This occurs when the attacker can provide forged messages and receive feedback about whether decryption succeeded. The issue stems from the implementation of ECDH, which fails to verify the validity of the communication partner's public key, allowing attackers to exfiltrate the victim's private key by choosing an altered curve. An attack requires the ability to initiate message decryption and record the result, and the victim's key must offer an ECDH public key.
Recommendations
Upgrade to version 4.3.0 or later.
If you are upgrading from a version <4.0.0, it is highly recommended to read the
High-Level API Changes section of the openpgp 4.0.0 release.Exploit
Correção
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openpgp.Js