PT-2018-19065 · Open Whisper Systems · Open Whisper Signal

Published 2018-04-10 · Updated 2019-10-03 · CVE-2018-9840

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Whisper Signal versions prior to 2.23.2

Description The issue allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions. This includes opening the app, clicking on cancel, and using the home button.

Recommendations For versions prior to 2.23.2, update to version 2.23.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2018-9840

Affected Products

Open Whisper Signal

References · 5

• https://github.com/signalapp/Signal-iOS/commit/018a35df7b42b4941cb4dfc9f462b37c3fafd9e9 · Patch
• https://github.com/signalapp/Signal-iOS/commits/release/2.23.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-9840 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9840 · Vendor Advisory
• http://nint.en.do/Signal-Bypass-Screen-locker.php · Note