CVE-2015-8013

High

Published: 25/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

s2k.js in OpenPGP.js allows decrypting arbitrary messages regardless of passphrase for crafted PGP keys, enabling remote attackers to bypass authentication if message decryption is used as an authentication mechanism.

Risk Assessment

Organizations may be exposed to attacks that allow unauthorized access to systems if message decryption is used as an authentication method.

Recommendation

It is recommended to update OpenPGP.js to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in OpenPGP.js

CVE-2023-41037Medium
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In versions up to 5.9.0, during the verification of Cleartext Signed Messages, any data preceding the 'Hash: ...' header was ignored, allowing attackers to add arbitrary text that could be perceived as signed.

Original NVD description (English source)

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.