{"action":"created","issue":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/298","labels_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/298/labels{/name}","comments_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/298/comments","events_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/298/events","html_url":"https://github.com/openpgpjs/openpgpjs/pull/298","id":59676821,"number":298,"title":"Check validity of key packet before signature verification","user":{"login":"toberndo","id":1164474,"avatar_url":"https://avatars.githubusercontent.com/u/1164474?v=3","gravatar_id":"","url":"https://api.github.com/users/toberndo","html_url":"https://github.com/toberndo","followers_url":"https://api.github.com/users/toberndo/followers","following_url":"https://api.github.com/users/toberndo/following{/other_user}","gists_url":"https://api.github.com/users/toberndo/gists{/gist_id}","starred_url":"https://api.github.com/users/toberndo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toberndo/subscriptions","organizations_url":"https://api.github.com/users/toberndo/orgs","repos_url":"https://api.github.com/users/toberndo/repos","events_url":"https://api.github.com/users/toberndo/events{/privacy}","received_events_url":"https://api.github.com/users/toberndo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/labels/Security","name":"Security","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-03-03T17:37:14Z","updated_at":"2015-03-04T06:28:59Z","closed_at":"2015-03-04T06:17:51Z","pull_request":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/pulls/298","html_url":"https://github.com/openpgpjs/openpgpjs/pull/298","diff_url":"https://github.com/openpgpjs/openpgpjs/pull/298.diff","patch_url":"https://github.com/openpgpjs/openpgpjs/pull/298.patch"},"body":"OpenPGP.js does not validate sub keys before using them for signature verification.\r\n\r\nAttack scenario:\r\nAlice uses insecure channel to send public key to Bob. MITM attacker adds subkey to Alice's key. Bob verifies fingerprint of Alice's key but not of the subkeys. Attacker can send messages to Bob signed with the fake subkey, pretending to come from Alice.\r\n\r\nWith this fix primary and subkey packets are validated before used in signature verification.\r\n\r\nBug reported by: @cure53"},"comment":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/comments/77103937","html_url":"https://github.com/openpgpjs/openpgpjs/pull/298#issuecomment-77103937","issue_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/298","id":77103937,"user":{"login":"tanx","id":1374174,"avatar_url":"https://avatars.githubusercontent.com/u/1374174?v=3","gravatar_id":"","url":"https://api.github.com/users/tanx","html_url":"https://github.com/tanx","followers_url":"https://api.github.com/users/tanx/followers","following_url":"https://api.github.com/users/tanx/following{/other_user}","gists_url":"https://api.github.com/users/tanx/gists{/gist_id}","starred_url":"https://api.github.com/users/tanx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tanx/subscriptions","organizations_url":"https://api.github.com/users/tanx/orgs","repos_url":"https://api.github.com/users/tanx/repos","events_url":"https://api.github.com/users/tanx/events{/privacy}","received_events_url":"https://api.github.com/users/tanx/received_events","type":"User","site_admin":false},"created_at":"2015-03-04T06:28:58Z","updated_at":"2015-03-04T06:28:58Z","body":"Thanks @toberndo and @cure53\r\n\r\nReleased as [v0.11.1](https://github.com/openpgpjs/openpgpjs/releases/tag/v0.11.1)"}}