CVE-2015-8013

7.5 HIGH
Published: July 25, 2017 Modified: May 13, 2026
View on NVD

Description

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/30/5
Source: cve@mitre.org
Mailing List
http://www.securityfocus.com/bid/77088
Source: cve@mitre.org
Third Party Advisory VDB Entry
https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29
Source: cve@mitre.org
Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/30/5
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://www.securityfocus.com/bid/77088
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry
https://github.com/openpgpjs/openpgpjs/commit/668a9bbe7033f3f475576209305eb57a54306d29
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Third Party Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
1.1%
78th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-310

Affected Vendors

openpgpjs

Related CVEs

CVE-2026-8654 N/A
CVE-2026-6646 6.4
CVE-2026-4094 8.1
CVE-2026-41702 7.8
CVE-2026-43490 N/A