PT-2026-21617 · Crates.Io · Pgp

Publicado 2026-02-13 · Atualizado 2026-02-13

OSV

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.

Details

When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.

Impact

While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.

Attribution

Discovered internally in the course of rPGP development work.

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

GHSA-C7PH-F7JM-XV4W

Produtos afetados

Pgp

Referências · 3

• https://github.com/rpgp/rpgp/security/advisories/GHSA-c7ph-f7jm-xv4w · Nota
• https://github.com/rpgp/rpgp · Nota
• https://osv.dev/vulnerability/GHSA-c7ph-f7jm-xv4w · Aviso do Fabricante