{"id":"GHSA-c7ph-f7jm-xv4w","aliases":[],"status":"published","title":"rPGP's integrity protection of encrypted data was not always checked","description":"### Summary\nFor some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.\n\n### Details\nWhen decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.\n\n### Impact\nWhile the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.\n\n### Attribution\nDiscovered internally in the course of rPGP development work.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-354"],"published":"2026-02-13T20:55:20Z","modified":"2026-02-22T23:23:41Z","fixes":[{"ecosystem":"crates.io","package":"pgp","fixed_in":["0.19.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"pgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0-alpha.0"},{"fixed":"0.19.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"pgp","ranges":[{"type":"SEMVER","events":[{"introduced":"0.16.0-alpha.0"},{"fixed":"0.19.0"}]}]}],"references":[{"url":"https://github.com/rpgp/rpgp/security/advisories/GHSA-c7ph-f7jm-xv4w","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c7ph-f7jm-xv4w"},{"url":"https://github.com/rpgp/rpgp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-c7ph-f7jm-xv4w","title":"rPGP's integrity protection of encrypted data was not always checked","description":"### Summary\nFor some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.\n\n### Details\nWhen decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.\n\n### Impact\nWhile the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.\n\n### Attribution\nDiscovered internally in the course of rPGP development work.","status":"published","published":"2026-02-13T20:55:20Z","modified":"2026-02-13T20:55:21Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"osv":[{"id":"GHSA-c7ph-f7jm-xv4w","title":"rPGP's integrity protection of encrypted data was not always checked","description":"### Summary\nFor some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.\n\n### Details\nWhen decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.\n\n### Impact\nWhile the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.\n\n### Attribution\nDiscovered internally in the course of rPGP development work.","status":"published","published":"2026-02-13T20:55:20Z","modified":"2026-02-22T23:23:41.778238Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}