PT-2021-14467 · Unknown · Wrongthink

Parabirb · Published 2021-03-19 · Updated 2021-03-25 · CVE-2021-21387

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wrongthink versions 2.0.0 through 2.2.x

Description The issue concerns inadequate encryption strength in the Wrongthink peer-to-peer, end-to-end encrypted messenger. Part of the secret identity key was disclosed by the fingerprint used for connection. The safety number was improperly calculated, using part of one of the public identity keys instead of being derived from both public identity keys, potentially leading to exploitable issues in the real world. Additionally, there was inadequate encryption strength due to the use of 1024-bit DSA keys.

Recommendations For versions 2.0.0 through 2.2.x, update to version 2.3.0 to resolve the issues with inadequate encryption strength and improper safety number calculation. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Fix

Improperly Implemented Security Check for Standard

Cleartext Transmission of Sensitive Information

Inadequate Encryption Strength

Weakness Enumeration

CWE-358

CWE-319

CWE-326

Related Identifiers

CVE-2021-21387

GHSA-5JXH-6378-RG7V

Affected Products

Wrongthink

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-21387 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21387 · Vendor Advisory
• https://t.me/cibsecurity/25188 · Telegram Post
• https://github.com/parabirb/wrongthink/security/advisories/GHSA-5jxh-6378-rg7v · Note
• https://t.me/cvenotify/11603 · Telegram Post