{"metadata": {"vulnerability": "cve-2023-41037", "count": 22, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 16}}, "data": [{"timestamp": "2023-08-22T16:57:23.931Z", "date_only": false, "value": "2023-08-22T16:57:23.931Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2023-41037", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-08-29T16:46:47.708Z", "date_only": false, "value": "2023-08-29T16:46:47.708Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-41037", "field": "cveMetadata.datePublished"}, {"timestamp": "2023-08-29T16:46:47.708Z", "date_only": false, "value": "2023-08-29T16:46:47.708Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2023-41037", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-08-29T17:15:00Z", "date_only": false, "value": "2023-08-29T17:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2023-41037", "record": "GSD-2023-41037", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2023-08-29T17:15:13Z", "date_only": false, "value": "2023-08-29T17:15:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CH3C-V47X-4PGP", "record": "GHSA-CH3C-V47X-4PGP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2023-08-29T17:15:13.003Z", "date_only": false, "value": "2023-08-29T17:15:13.003", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-41037", "record": "FKIE_CVE-2023-41037", "field": "published"}, {"timestamp": "2023-08-29T17:36:40Z", "date_only": false, "value": "2023-08-29T17:36:40Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CH3C-V47X-4PGP", "record": "GHSA-CH3C-V47X-4PGP", "field": "published"}, {"timestamp": "2023-08-29T17:36:40Z", "date_only": false, "value": "2023-08-29T17:36:40Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CH3C-V47X-4PGP", "record": "GHSA-CH3C-V47X-4PGP", "field": "modified"}, {"timestamp": "2023-08-29T20:17:35Z", "date_only": false, "value": "2023-08-29T20:17:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/69360", "record": "CVE-2023-41037", "field": "creation_timestamp", "uuid": "0c8d47b9-5f81-43cf-b7bc-5edb7a52b1fc", "content": "\u203c CVE-2023-41037 \u203c\n\nOpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a \"Hash: ...\" header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the \"Hash: ...\" texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a \"sanitised\" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/69360"}, {"timestamp": "2023-08-29T22:00:00Z", "date_only": false, "value": "2023-08-29T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2211", "record": "WID-SEC-W-2023-2211", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-08-29T22:00:00Z", "date_only": false, "value": "2023-08-29T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2211", "record": "WID-SEC-W-2023-2211", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-08-29T22:00:00Z", "date_only": false, "value": "2023-08-29T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2211", "record": "WID-SEC-W-2023-2211", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-08-29T22:00:00Z", "date_only": false, "value": "2023-08-29T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2211", "record": "WID-SEC-W-2023-2211", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-09-08T14:01:00Z", "date_only": false, "value": "2023-09-08T14:01Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2023-41037", "record": "GSD-2023-41037", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-12-13T01:20:45.689Z", "date_only": false, "value": "2023-12-13T01:20:45.689904Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-41037", "record": "GSD-2023-41037", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-02T18:46:11.562Z", "date_only": false, "value": "2024-08-02T18:46:11.562Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2023-41037", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T17:57:49.056Z", "date_only": false, "value": "2024-08-15T17:57:49.056+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2211", "record": "WID-SEC-W-2023-2211", "field": "document.tracking.generator.date"}, {"timestamp": "2024-09-30T17:34:19.116Z", "date_only": false, "value": "2024-09-30T17:34:19.116832Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-41037", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2024-09-30T17:34:19.116Z", "date_only": false, "value": "2024-09-30T17:34:19.116832Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-41037", "record": "FKIE_CVE-2023-41037", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-09-30T17:43:47.802Z", "date_only": false, "value": "2024-09-30T17:43:47.802Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2023-41037", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-09-30T17:43:47.802Z", "date_only": false, "value": "2024-09-30T17:43:47.802Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-41037", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T06:20:13.173Z", "date_only": false, "value": "2026-06-17T06:20:13.173", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-41037", "record": "FKIE_CVE-2023-41037", "field": "lastModified"}]}