PT-2018-19065 · Open Whisper Systems · Open Whisper Signal

Publicado 2018-04-10 · Atualizado 2019-10-03 · CVE-2018-9840

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Whisper Signal versions prior to 2.23.2

Description The issue allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions. This includes opening the app, clicking on cancel, and using the home button.

Recommendations For versions prior to 2.23.2, update to version 2.23.2 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2018-9840

Produtos afetados

Open Whisper Signal

Referências · 5

• https://github.com/signalapp/Signal-iOS/commit/018a35df7b42b4941cb4dfc9f462b37c3fafd9e9 · Correção
• https://github.com/signalapp/Signal-iOS/commits/release/2.23.2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-9840 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-9840 · Aviso do Fabricante
• http://nint.en.do/Signal-Bypass-Screen-locker.php · Nota