CVE-2023-41037
1 advisory.
npm/openpgp CVE-2023-41037: medium 4.3, EPSS 0.35%
Cleartext Signed Message Signature Spoofing in openpgp
Action: Upgrade openpgp to 4.10.11 or later.
npm i openpgp@4.10.11npm i openpgp@5.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.10.11 | - |
| 5.0.0 | 5.10.1 | - |
Fixed versions
| 4.10.11 | 5.10.1 |
Sources
- osv: GHSA-ch3c-v47x-4pgp
- https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-ch3c-v47x-4pgp
- https://nvd.nist.gov/vuln/detail/CVE-2023-41037
- https://github.com/openpgpjs/openpgpjs/commit/6b43e02a254853f5ff508ebd1b07541f78b7c566
- https://github.com/openpgpjs/openpgpjs
- https://github.com/openpgpjs/openpgpjs/releases/tag/v4.10.11
- https://github.com/openpgpjs/openpgpjs/releases/tag/v5.10.1
CVE-2023-41037 · published · modified · JSON