PT-2021-23083 · Wire · Wire

Published 2021-10-04 · Updated 2022-08-12 · CVE-2021-41094

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wire versions prior to 3.70

Description The issue allows users to bypass the mandatory encryption at rest feature by disabling their device passcode. When the app launches, it attempts to enable encryption at rest by generating encryption keys via the Secure Enclave, but it fails silently if no device passcode is set. The user is not notified that encryption at rest is not active, as this feature is hidden from them.

Recommendations For versions prior to 3.70, update to version 3.70 to resolve the issue. As a temporary workaround, consider enabling the device passcode to ensure encryption at rest is active.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-41094

GHSA-H4M7-PR8H-J7RF

Affected Products

Wire

References · 4

• https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746 · Patch
• https://osv.dev/vulnerability/CVE-2021-41094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41094 · Security Note
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf · Note