CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

advisory packetstormsecurity.com
advisory github.com
advisory github.com
advisory bsi.bund.de
patch github.com
report sec-consult.com