{"id":"CVE-2019-9153","aliases":["EUVD-2019-0640","GHSA-qwqc-28w3-fww6"],"status":"published","title":"Message Signature Bypass in openpgp","description":"Improper Verification of a Cryptographic Signature in OpenPGP.js \u003c=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a \"standalone\" or \"timestamp\" signature.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02013,"percentile":0.81021,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-347"],"published":"2019-08-22T15:30:33Z","modified":"2026-10-20T10:50:03Z","exploits":[{"source":"pocgithub","id":"ZenyWay/opgp-service-cve-2019-9153","title":"ZenyWay/opgp-service-cve-2019-9153","date":"2019-09-11","url":"https://github.com/ZenyWay/opgp-service-cve-2019-9153"}],"fixes":[{"ecosystem":"npm","package":"openpgp","fixed_in":["4.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.2"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"openpgp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]}],"products":[{"vendor":"openpgpjs","product":"openpgpjs"}],"references":[{"url":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","advisory","web"]},{"url":"https://github.com/openpgpjs/openpgpjs/pull/816","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/openpgpjs/openpgpjs/pull/797/commits/327d3e5392a6f59a4270569d200c7f7a2bfc4cbc","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9153","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-OPENPGP-460248","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1160","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwqc-28w3-fww6"},{"url":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9153","description":"Improper Verification of a Cryptographic Signature in OpenPGP.js \u003c=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a \"standalone\" or \"timestamp\" signature.","status":"published","published":"2019-08-22T15:30:33Z","modified":"2024-08-04T21:38:46.485Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-0640","description":"Improper Verification of a Cryptographic Signature in OpenPGP.js \u003c=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a \"standalone\" or \"timestamp\" signature.","status":"published","published":"2019-08-22T15:30:33Z","modified":"2024-08-04T21:38:46Z","updated_at":"2026-11-03T03:06:40.408517Z"}],"ghsa":[{"id":"GHSA-qwqc-28w3-fww6","title":"Message Signature Bypass in openpgp","description":"Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.\n\n\n## Recommendation\n\nUpgrade to version 4.2.0 or later.\nIf you are upgrading from a version \u003c4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0","status":"published","published":"2019-08-23T21:42:20Z","modified":"2023-01-09T05:01:55Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2019-9153","description":"Improper Verification of a Cryptographic Signature in OpenPGP.js \u003c=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a \"standalone\" or \"timestamp\" signature.","status":"published","published":"2019-08-22T16:15:10.383Z","modified":"2026-06-17T02:43:09.697Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"CVE-2019-9153","description":"Improper Verification of a Cryptographic Signature in OpenPGP.js \u003c=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a \"standalone\" or \"timestamp\" signature.","status":"published","published":"2019-08-22T16:15:10.383Z","modified":"2026-10-20T10:50:03.80288443Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"GHSA-qwqc-28w3-fww6","title":"Message Signature Bypass in openpgp","description":"Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.\n\n\n## Recommendation\n\nUpgrade to version 4.2.0 or later.\nIf you are upgrading from a version \u003c4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0","status":"published","published":"2019-08-23T21:42:20Z","modified":"2023-11-08T04:01:46.612755Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}