CVE-2023-41037

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.

• CWE-347

• https://github.com/openpgpjs/openpgpjs/commit/6b43e02a254853f5ff508ebd1b07541f78b7c566Patch
• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-ch3c-v47x-4pgpExploit, Vendor Advisory
• https://github.com/openpgpjs/openpgpjs/commit/6b43e02a254853f5ff508ebd1b07541f78b7c566Patch
• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-ch3c-v47x-4pgpExploit, Vendor Advisory

Published

Aug 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41030Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 t…9.8
• CVE-2023-41031Command injection in homemng.htm in Juplink RX4-1500 version…8.8
• CVE-2023-41032A vulnerability has been identified in Parasolid V34.1 (All …7.8
• CVE-2023-41033A vulnerability has been identified in Parasolid V35.0 (All …7.8
• CVE-2023-41034Eclipse Leshan is a device management server and client Java…9.8
• CVE-2023-41036Macvim is a text editor for MacOS. Prior to version 178, Mac…7.8
• CVE-2023-41038Firebird is a relational database. Versions 4.0.0 through 4.…7.5
• CVE-2023-41039RestrictedPython is a restricted execution environment for P…7.7
• CVE-2023-4104An invalid Polkit Authentication check and missing authentic…5.5
• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41041Graylog is a free and open log management platform. In a mul…3.1
• CVE-2023-41042Discourse is an open-source discussion platform. Prior to ve…6.5