Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature openpgp is a JavaScript implementation of the OpenPGP protocol. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the `openpgp.verify` or `openpgp.decrypt` functions. An attacker can manipulate the message content to appear as legitimately signed by constructing a message with any data of their choice, using a valid signature from a different message. Note: This is only exploitable if the attacker has access to a valid signature and the plaintext data that was legitimately signed. How to fix Improper Verification of Cryptographic Signature? Upgrade `openpgp` to version 5.11.3, 6.1.1 or higher.	>=5.0.1 <5.11.3>=6.0.0-alpha.0 <6.1.1

Improper Verification of Cryptographic Signature

openpgp is a JavaScript implementation of the OpenPGP protocol.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the openpgp.verify or openpgp.decrypt functions. An attacker can manipulate the message content to appear as legitimately signed by constructing a message with any data of their choice, using a valid signature from a different message.

Note:

This is only exploitable if the attacker has access to a valid signature and the plaintext data that was legitimately signed.

How to fix Improper Verification of Cryptographic Signature?

Upgrade openpgp to version 5.11.3, 6.1.1 or higher.

>=5.0.1 <5.11.3>=6.0.0-alpha.0 <6.1.1

Go back to all versions of this package