Is CVE-2019-9155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-9155 being exploited in the wild.

How severe is CVE-2019-9155?

Low severity, with a CVSS score of 3, published 23 August 2019.

Which products and versions are affected?

openpgp (npm) SEMVER:introduced=0,fixed=4.3.0.

Is there a fix for CVE-2019-9155?

Yes. openpgp (npm): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-9155 attacked?

It is attacked over the network.

Am I affected by CVE-2019-9155?

Check whether you run openpgp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-9155: OpenPGP.js invalid curve attack in ECDH

CVE-2019-9155 · Severity: low · CVSS 3 · Published 2019-08-23

OpenPGP.js is a JavaScript library used to encrypt and decrypt messages using the PGP standard. A vulnerability in versions before 4.3.0 fails to validate the authenticity of encryption keys during ECDH (Elliptic Curve Diffie-Hellman) operations, allowing an attacker to substitute a malicious curve and potentially extract the victim's private encryption key if they can trick the victim into decrypting attacker-controlled messages.

Technologies: openpgp (npm). Vendors: npm.

Quick answers

Is CVE-2019-9155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-9155 being exploited in the wild.
How severe is CVE-2019-9155?: Low severity, with a CVSS score of 3, published 23 August 2019.
Which products and versions are affected?: openpgp (npm) SEMVER:introduced=0,fixed=4.3.0.
Is there a fix for CVE-2019-9155?: Yes. openpgp (npm): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-9155 attacked?: It is attacked over the network.
Am I affected by CVE-2019-9155?: Check whether you run openpgp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openpgp (npm): upgrade to 4.3.0 or later
```
npm install openpgp@4.3.0
```

Technical details

The vulnerability is an invalid curve attack (CWE-327) in the ECDH implementation of OpenPGP.js prior to version 4.3.0. The package fails to validate that the peer's public key lies on the correct elliptic curve, instead calculating the shared secret using an attacker-controlled substituted curve. An attacker must initiate message decryption and observe the results to exfiltrate the victim's private key; the attack requires the victim to possess an ECDH-capable public key. The vulnerability was fixed in version 4.3.0 and patched via GitHub PR #853.

Affected products

OpenPGP.js openpgp prior to 4.3.0

Identifiers

CVE-2019-9155
GHSA-77jf-fjjf-xcww

Timeline

2019-08-23: disclosed: Advisory published
2019-02-05: patched: Fix merged in PR #853; version 4.3.0 released

References

https://github.com/openpgpjs/openpgpjs/pull/853

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.