PT-2021-7456 · Keybase · Keybase Client For Ios+1

Published 2021-11-09 · Updated 2021-11-28 · CVE-2021-34421

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keybase Client for Android versions prior to 5.8.0 Keybase Client for iOS versions prior to 5.8.0

Description The issue arises from the incomplete cleanup of temporary or auxiliary resources, which could allow a remote attacker to disclose protected information. This occurs when the receiving user places the chat session in the background while the sending user explodes messages, leading to the potential disclosure of sensitive information meant to be deleted from the customer's device.

Recommendations For Keybase Client for Android versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue. For Keybase Client for iOS versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

BDU:2022-06390

CVE-2021-34421

Affected Products

Keybase Client For Android

Keybase Client For Ios

References · 9

• https://bdu.fstec.ru/vul/2022-06390 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34421 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34421 · Vendor Advisory
• https://t.me/pentestingnews/14754 · Telegram Post
• https://t.me/cibsecurity/32269 · Telegram Post
• https://t.me/cybersecuritytechnologies/4856 · Telegram Post
• https://t.me/pentestingnews/14669 · Telegram Post
• https://explore.zoom.us/en/trust/security/security-bulletin · Note
• https://t.me/thebugbountyhunter/5812 · Telegram Post