Is CVE-2019-9154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-9154 being exploited in the wild.

How severe is CVE-2019-9154?

Low severity, with a CVSS score of 3, published 23 August 2019.

Which products and versions are affected?

openpgp (npm) SEMVER:introduced=0,fixed=4.2.0; OpenPGP.js prior to 4.2.0.

Is there a fix for CVE-2019-9154?

Yes. openpgp (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-9154 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-9154?

Check whether you run openpgp (npm) or OpenPGP.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-9154: OpenPGP.js improper key verification in signature subpackets

CVE-2019-9154 · Severity: low · CVSS 3 · Published 2019-08-23

OpenPGP.js is a JavaScript library used to encrypt and sign messages with PGP encryption. Versions prior to 4.2.0 fail to properly verify whether signature subpackets are cryptographically protected, allowing an attacker to modify certification or revocation signatures. This could trick users into using obsolete or compromised keys for encryption, potentially exposing sensitive communications.

Technologies: openpgp (npm). Vendors: npm.

Quick answers

Is CVE-2019-9154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-9154 being exploited in the wild.
How severe is CVE-2019-9154?: Low severity, with a CVSS score of 3, published 23 August 2019.
Which products and versions are affected?: openpgp (npm) SEMVER:introduced=0,fixed=4.2.0; OpenPGP.js prior to 4.2.0.
Is there a fix for CVE-2019-9154?: Yes. openpgp (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-9154 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-9154?: Check whether you run openpgp (npm) or OpenPGP.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openpgp (npm): upgrade to 4.2.0 or later
```
npm install openpgp@4.2.0
```

Technical details

The vulnerability stems from improper handling of OpenPGP signature subpackets. The OpenPGP standard distinguishes between hashed (cryptographically protected) and unhashed subpackets; the library failed to validate this distinction and allowed unhashed subpacket data to overwrite information from hashed subpackets. An attacker with the ability to deliver a manipulated key or key update to a victim can exploit this to alter key certification or revocation signatures (CWE-347: Improper Verification of Cryptographic Signature). The attack requires victim interaction (importing or updating a key) but operates over the network. Remediation is available in version 4.2.0 and later.

Affected products

OpenPGP.js OpenPGP.js prior to 4.2.0

Identifiers

CVE-2019-9154
GHSA-hfmf-q43v-2ffj

Timeline

2019-08-23: disclosed
2018-11-05: patched: Security fixes merged into master branch

References

https://github.com/openpgpjs/openpgpjs/pull/797

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.