Detections
Analytics

SCA: security update for openpgp (GHSA-ch3c-v47x-4pgp)

medium Tenable Cloud Security Plugin ID 413904

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext
 Signed Messages are cryptographically signed messages where the signed text is readable without special
 tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute
 the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when
 verifying the signature. As a result, malicious parties could add arbitrary text to a third-party
 Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or
 application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the
 returned `verified` property, discarding the associated `data` information, and instead _visually
 trusting_ the contents of the original message. Since `verificationResult.data` would always contain the
 actual signed data, users and apps that check this information are not vulnerable. Similarly, given a
 CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the
 contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object
 (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This
 issue has been addressed in version 5.10.1 (current stable version) which will reject messages when
 calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject
 messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to
 upgrade should check the contents of `verificationResult.data` to see what data was actually signed,
 rather than visually trusting the contents of the armored message. (CVE-2023-41037)

See Also

https://github.com/advisories/GHSA-ch3c-v47x-4pgp

Plugin Details

Severity: Medium

ID: 413904

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2023-41037

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/29/2023

Vulnerability Publication Date: 8/29/2023

Reference Information

CVE: CVE-2023-41037

cwe: CWE-347