CVE-2019-9154: Improper Key Verification in openpgp

openpgp Updated 02 Oct 2025

Summary

23/08/2019

Disclosed on

CVE-2019-9154

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2019-9154: Improper Key Verification in openpgp. Affects openpgp versions < 4.2.0. Fixed in 4.2.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The openpgp package is an open-source library that implements the OpenPGP standard for encryption and decryption of data. It provides functions for generating and managing cryptographic keys, signing and verifying signatures, and encrypting and decrypting messages. The package is widely used in various applications for secure communication and data protection. However, versions prior to 4.2.0 are vulnerable to an issue related to improper key verification.

Vulnerability Detail

The vulnerability in openpgp arises from the improper verification of key subpackets. The OpenPGP standard allows signature packets to have subpackets, which can be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package fails to verify whether a subpacket is hashed, allowing an attacker to manipulate the contents of a key certification signature or revocation signature. This manipulation could lead to a victim using an obsolete key for encryption, compromising the security of their communications. The vulnerability requires the victim to import a manipulated key or update an existing key with a manipulated version.

How To Fix

Minimum fixed version

4.2.0

This is the first release that contains the fix.

npm install openpgp@4.2.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

The openpgp package prior to version 4.2.0 is vulnerable to improper key verification, which can allow an attacker to manipulate key certification or revocation signatures. To mitigate this vulnerability, it is recommended to upgrade to version 4.2.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for openpgp →

FAQ

What is the impact of this vulnerability?

The vulnerability allows an attacker to manipulate key certification or revocation signatures, potentially leading to the use of obsolete keys for encryption.

How can I check if my application is affected?

You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time monitoring and alerts for open-source vulnerabilities.