PT-2019-19968 · Signal · Signal Private Messenger+3

Julio Cesar Fort · Published 2019-03-23 · Updated 2022-04-07 · CVE-2019-9970

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open Whisper Signal (aka Signal-Desktop) versions 1.23.1 and earlier Signal Private Messenger application versions 4.35.3 and earlier for Android

Description The issue occurs when the application displays messages containing URLs, making it vulnerable to an IDN homograph attack. This happens because the application produces a clickable link even if Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Recommendations For Open Whisper Signal (aka Signal-Desktop) versions 1.23.1 and earlier, update to a version later than 1.23.1 to resolve the issue. For Signal Private Messenger application versions 4.35.3 and earlier for Android, update to a version later than 4.35.3 to resolve the issue. As a temporary workaround, consider disabling the display of clickable links in messages until a patch is available.

Fix

Related Identifiers

CVE-2019-9970

Affected Products

Open Whisper Signal

Esignal

Signal Desktop

Signal Private Messenger

References · 5

• https://osv.dev/vulnerability/CVE-2019-9970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9970 · Security Note
• https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt · Note
• http://securityfocus.com/bid/107550 · Note
• https://t.me/cvenotify/28596 · Telegram Post