PT-2022-16139 · Wire · Wire-Ios

Published 2022-03-11 · Updated 2022-03-18 · CVE-2022-23625

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wire-ios versions prior to 3.95

Description The issue is related to malformed resource identifiers that can cause the iOS Wire Client to crash repeatedly on launch. These identifiers can be sent between Wire users, leading to undesirable behavior. The root cause is in the code responsible for removing sensible tokens before logging, which may fail and cause a crash. Although the greater Wire system remains functional, users are advised to upgrade as soon as possible.

Recommendations For versions prior to 3.95, upgrade to version 3.95 or later as soon as possible to resolve the issue. As a temporary workaround, consider avoiding the use of malformed resource identifiers to minimize the risk of application crashes.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2022-23625

GHSA-3XVH-X964-572H

GHSA-RQ36-8QFP-79MC

Affected Products

Wire-Ios

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23625.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-23625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23625 · Security Note
• ❌ https://github.com/wireapp/wire-ios-transport/commit/02e90aa45edaf7eb2d8b97fa2377cd8104274170 · Patch, Deleted
• ❌ https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-3xvh-x964-572h · Patch, Deleted
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-rq36-8qfp-79mc · Note