PT-2022-27425 · Unknown+1 · Simplechat+1

Published 2022-11-12 · Updated 2022-11-17 · CVE-2022-45195

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpleXMQ versions prior to 3.4.0 SimpleX Chat versions prior to 4.2

Description The issue occurs in the X3DH key exchange for the double ratchet protocol, where a key derivation function is not applied to intended data. This can interfere with forward secrecy and have other impacts if there is a compromise of a single private key.

Recommendations For SimpleXMQ versions prior to 3.4.0, update to version 3.4.0 or later. For SimpleX Chat versions prior to 4.2, update to version 4.2 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2022-45195

Affected Products

Simplechat

Simplexmq

References · 7

• 🔥 https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf · Exploit
• https://github.com/simplex-chat/simplexmq/pull/548 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-45195 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45195 · Vendor Advisory
• https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html · Vendor Advisory
• https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0 · Note
• https://t.me/cvenotify/37578 · Telegram Post