PT-2019-19968 · Signal · Signal Private Messenger+3

Julio Cesar Fort · Publicado 2019-03-23 · Atualizado 2022-04-07 · CVE-2019-9970

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open Whisper Signal (aka Signal-Desktop) versions 1.23.1 and earlier Signal Private Messenger application versions 4.35.3 and earlier for Android

Description The issue occurs when the application displays messages containing URLs, making it vulnerable to an IDN homograph attack. This happens because the application produces a clickable link even if Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Recommendations For Open Whisper Signal (aka Signal-Desktop) versions 1.23.1 and earlier, update to a version later than 1.23.1 to resolve the issue. For Signal Private Messenger application versions 4.35.3 and earlier for Android, update to a version later than 4.35.3 to resolve the issue. As a temporary workaround, consider disabling the display of clickable links in messages until a patch is available.

Correção

Identificadores relacionados

CVE-2019-9970

Produtos afetados

Open Whisper Signal

Esignal

Signal Desktop

Signal Private Messenger

Referências · 5

• https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt · Nota
• https://osv.dev/vulnerability/CVE-2019-9970 · Aviso do Fabricante
• http://securityfocus.com/bid/107550 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9970 · Nota de Segurança
• https://t.me/cvenotify/28596 · Publicação no Telegram