Is CVE-2015-8013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-8013 being exploited in the wild.

How severe is CVE-2015-8013?

Low severity, with a CVSS score of 3, published 17 May 2022.

Which products and versions are affected?

openpgp (npm) SEMVER:introduced=0,fixed=1.3.0.

Is there a fix for CVE-2015-8013?

Yes. openpgp (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-8013 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-8013?

Check whether you run openpgp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8013: OpenPGP.js decryption bypass on crafted symmetric keys

CVE-2015-8013 · Severity: low · CVSS 3 · Published 2022-05-17

OpenPGP.js is a popular library for implementing OpenPGP encryption and decryption in JavaScript applications. Versions 1.2.0 and earlier contain a flaw that allows an attacker to craft malicious PGP keys that bypass passphrase validation, causing the library to decrypt messages without requiring the correct password. If an application uses message decryption as an authentication mechanism, an attacker could forge or access encrypted communications intended for others.

Technologies: openpgp (npm). Vendors: npm.

Quick answers

Is CVE-2015-8013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-8013 being exploited in the wild.
How severe is CVE-2015-8013?: Low severity, with a CVSS score of 3, published 17 May 2022.
Which products and versions are affected?: openpgp (npm) SEMVER:introduced=0,fixed=1.3.0.
Is there a fix for CVE-2015-8013?: Yes. openpgp (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8013 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-8013?: Check whether you run openpgp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openpgp (npm): upgrade to 1.3.0 or later
```
npm install openpgp@1.3.0
```

Technical details

The vulnerability exists in the s2k.js module, which handles key derivation functions (S2K) used to convert passphrases into encryption keys. The library fails to properly validate unsupported S2K types, allowing an attacker to craft a symmetrically encrypted PGP message with a malicious S2K specifier that causes the decryption routine to proceed without proper passphrase verification. The attack is network-reachable and requires no user interaction or authentication; an attacker sends a crafted PGP message to a target application. The fix, released in version 1.3.0, adds exception handling to reject unsupported S2K types.

Affected products

OpenPGP OpenPGP.js 1.2.0 and earlier

Identifiers

CVE-2015-8013
GHSA-qmvq-f3fj-m3wg

Timeline

2015-10-30: disclosed
2015: patched: Fix released in version 1.3.0
2022-05-17: advisory: GHSA-qmvq-f3fj-m3wg published

References

https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.