PT-2019-14913 · Keybase · Keybase

Jeffrey Paul · Publicado 2019-09-29 · Atualizado 2019-10-08 · CVE-2019-16992

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keybase app version 2.13.2 for iOS

Description The issue concerns potentially insufficient notice that the app is using a user's private key to sign a cryptocurrency attestation for Stellar payments. This might be incompatible with a user's personal position on the semantics of an attestation.

Recommendations For Keybase app version 2.13.2, consider reviewing the app's settings and documentation to understand how it handles private keys and cryptocurrency attestations, and adjust usage accordingly to align with personal preferences on attestation semantics. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2019-16992

Produtos afetados

Keybase

Referências · 4

• https://github.com/keybase/keybase-issues/issues/3583 · Nota
• https://osv.dev/vulnerability/CVE-2019-16992 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16992 · Nota de Segurança
• https://sneak.berlin/20190929/keybase-backdoor · Nota