-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of S2K (String-to-Key) types in s2k.js. The commit diff shows that both the write() and produce_key() methods were modified to throw errors for unsupported S2K types (e.g., 'gnu'). Prior to the fix, these functions did not validate S2K types, allowing attackers to craft keys/messages that bypassed passphrase validation. The produce_key function is directly responsible for key derivation, and its failure to reject unknown S2K types would result in predictable/incorrect keys. The write function's lack of validation could enable creation of keys with invalid S2K specifications. Both are critical to the exploit chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openpgp | npm | < 1.3.0 | 1.3.0 |
JavaScriptJavaScriptA Semantic Attack on Google Gemini - Read the Latest Research