{"api_version":"1","generated_at":"2026-07-23T04:15:48+00:00","cve":"CVE-2019-9155","urls":{"html":"https://cve.report/CVE-2019-9155","api":"https://cve.report/api/cve/CVE-2019-9155.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-9155","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-9155"},"summary":{"title":"CVE-2019-9155","description":"A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-08-22 16:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-327"],"metrics":[],"references":[{"url":"https://github.com/openpgpjs/openpgpjs/pull/853","name":"https://github.com/openpgpjs/openpgpjs/pull/853","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"Fix ECDH message encryption for some session keys by twiss · Pull Request #853 · openpgpjs/openpgpjs · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0","name":"https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0","refsource":"CONFIRM","tags":["Release Notes"],"title":"Release v4.3.0 - Security Release · openpgpjs/openpgpjs · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html","name":"http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"OpenPGP.js 4.2.0 Signature Bypass / Invalid Curve Attack ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/","name":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Multiple Vulnerabilities in OpenPGP.js – SEC Consult","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e","name":"https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"],"title":"Fix ECDH message encryption for some session keys by twiss · Pull Request #853 · openpgpjs/openpgpjs · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1","name":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1","refsource":"MISC","tags":["Third Party Advisory"],"title":"BSI  -  Publications - Mailvelope Extensions Security Audit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9155","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9155","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"9155","vulnerable":"1","versionEndIncluding":"4.2.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openpgpjs","cpe5":"openpgpjs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-9155","qid":"981970","title":"Nodejs (npm) Security Update for openpgp (GHSA-77jf-fjjf-xcww)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-9155","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/","url":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/"},{"refsource":"MISC","name":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1","url":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1"},{"refsource":"CONFIRM","name":"https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0","url":"https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0"},{"refsource":"CONFIRM","name":"https://github.com/openpgpjs/openpgpjs/pull/853","url":"https://github.com/openpgpjs/openpgpjs/pull/853"},{"refsource":"CONFIRM","name":"https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e","url":"https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html","url":"http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html"}]}},"nvd":{"publishedDate":"2019-08-22 16:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-327"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.2,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openpgpjs:openpgpjs:*:*:*:*:*:*:*:*","versionEndIncluding":"4.2.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"9155","Ordinal":"147016","Title":"CVE-2019-9155","CVE":"CVE-2019-9155","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"9155","Ordinal":"1","NoteData":"A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"9155","Ordinal":"2","NoteData":"2019-08-22","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"9155","Ordinal":"3","NoteData":"2019-08-22","Type":"Other","Title":"Modified"}]}}}