Description
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
Remediation
References
http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
https://github.com/openpgpjs/openpgpjs/pull/853
https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e
https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0
https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1
Related Vulnerabilities
CVE-2016-1000338 Vulnerability in maven package org.bouncycastle:bcprov-jdk15on
CVE-2014-0219 Vulnerability in maven package org.apache.karaf:org.apache.karaf.main
CVE-2023-33544 Vulnerability in maven package io.hawt:hawtio-system
CVE-2017-16137 Vulnerability in npm package debug
CVE-2015-2582 Vulnerability in maven package org.keycloak:keycloak-saml-core