CVE-2015-8013

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-25 · updated 2026-06-17
Weakness: CWE-310

Description

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

Affected products

openpgpjs: through 1.2.0

References

http://www.openwall.com/lists/oss-security/2015/10/30/5
http://www.securityfocus.com/bid/77088
https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29
http://www.openwall.com/lists/oss-security/2015/10/30/5
http://www.securityfocus.com/bid/77088
https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29

Get alerted when CVE-2015-8013 or the next vulnerability affects your stack