PT-2024-26947 · Freefrom · Freefrom

Hayato Kimura + 3 · Published 2024-06-17 · Updated 2024-07-03 · CVE-2024-36279

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeFrom - the nostr client versions prior to 1.3.5

Description The issue exists due to reliance on obfuscation or encryption of security-relevant inputs without integrity checking. If exploited, the content of direct messages between users may be manipulated by a man-in-the-middle attack.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of direct messages until the update is applied.

Fix

Weakness Enumeration

CWE-649

Related Identifiers

CVE-2024-36279

Affected Products

Freefrom

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-36279 · Security Note
• https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930 · Note
• https://jvn.jp/en/jp/JVN55045256 · Note
• https://t.me/cvenotify/83451 · Telegram Post
• https://play.google.com/store/apps/details?id=com.freefrom · Note
• https://freefrom.space · Note