CVE-2024-36289

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36289
Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
https://freefrom.space/
https://jvn.jp/en/jp/JVN55045256/
https://play.google.com/store/apps/details?id=com.freefrom
https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
https://freefrom.space/
https://jvn.jp/en/jp/JVN55045256/
https://play.google.com/store/apps/details?id=com.freefrom
Configurations

No configuration.

History

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930 - () https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930 -
References () https://freefrom.space/ - () https://freefrom.space/ -
References () https://jvn.jp/en/jp/JVN55045256/ - () https://jvn.jp/en/jp/JVN55045256/ -
References () https://play.google.com/store/apps/details?id=com.freefrom - () https://play.google.com/store/apps/details?id=com.freefrom -

03 Jul 2024, 02:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-323

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) Existe un problema de reutilización de un par de claves nonce en el cifrado en las versiones de la aplicación "FreeFrom - the nostr client" anteriores a la 1.3.5 para Android e iOS. Si se explota esta vulnerabilidad, el contenido de los mensajes directos (DM) entre usuarios puede ser manipulado mediante un ataque de intermediario.

17 Jun 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-17 08:15

Updated : 2024-11-21 09:21

NVD link : CVE-2024-36289

Mitre link : CVE-2024-36289

CVE.ORG link : CVE-2024-36289

JSON object : View

Products Affected

No product.

CWE
CWE-323

Reusing a Nonce, Key Pair in Encryption