CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS
Percentile
30.2%
openpgp is vulnerable to PGP Signature Spoofing. The vulnerability exists due to ignoring text before the hash: ...
section. An attacker can append text to the start of of the line, which will appear as signed but the library ignores verifying it.