PT-2019-14913 · Keybase · Keybase

Jeffrey Paul · Published 2019-09-29 · Updated 2019-10-08 · CVE-2019-16992

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keybase app version 2.13.2 for iOS

Description The issue concerns potentially insufficient notice that the app is using a user's private key to sign a cryptocurrency attestation for Stellar payments. This might be incompatible with a user's personal position on the semantics of an attestation.

Recommendations For Keybase app version 2.13.2, consider reviewing the app's settings and documentation to understand how it handles private keys and cryptocurrency attestations, and adjust usage accordingly to align with personal preferences on attestation semantics. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-16992

Affected Products

Keybase

References · 4

• https://osv.dev/vulnerability/CVE-2019-16992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16992 · Security Note
• https://github.com/keybase/keybase-issues/issues/3583 · Note
• https://sneak.berlin/20190929/keybase-backdoor · Note