CVE-2024-36277 - Vulnerability Details - OpenCVE

Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00062.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeFrom K.K.

"FreeFrom - the nostr client" App for Android

affected

Version	Status	Constraints
`prior to 1.3.5`	affected	—

FreeFrom K.K.

"FreeFrom - the nostr client" App for iOS

affected

Version	Status	Constraints
`prior to 1.3.5`	affected	—

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
https://freefrom.space/
https://jvn.jp/en/jp/JVN55045256/
https://play.google.com/store/apps/details?id=com.freefrom

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00091}`	epss `{'score': 0.00138}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-06-17T07:33:55.100Z

Updated: 2024-08-02T03:37:05.045Z

Reserved: 2024-06-03T03:52:23.220Z

Link: CVE-2024-36277

Vulnrichment

Updated: 2024-08-02T03:37:05.045Z

NVD

Status : Awaiting Analysis

Published: 2024-06-17T08:15:48.847

Modified: 2024-11-21T09:21:58.537

Link: CVE-2024-36277

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-347

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36277", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-06-03T03:52:23.220Z", "datePublished": "2024-06-17T07:33:55.100Z", "dateUpdated": "2024-08-02T03:37:05.045Z"}, "containers": {"cna": {"affected": [{"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for Android", "versions": [{"version": "prior to 1.3.5", "status": "affected"}]}, {"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for iOS", "versions": [{"version": "prior to 1.3.5", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature issue exists in \"FreeFrom - the nostr client\" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures."}], "problemTypes": [{"descriptions": [{"description": "Improper Verification of Cryptographic Signature", "lang": "en", "type": "text"}]}], "references": [{"url": "https://freefrom.space/"}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom"}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"url": "https://jvn.jp/en/jp/JVN55045256/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-17T07:33:55.100Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-347", "lang": "en", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "affected": [{"vendor": "freefrom_kk", "product": "freefrom_the_nostr_client_app", "cpes": ["cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.3.5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T14:24:09.463816Z", "id": "CVE-2024-36277", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T16:30:29.244Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:05.045Z"}, "title": "CVE Program Container", "references": [{"url": "https://freefrom.space/", "tags": ["x_transferred"]}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom", "tags": ["x_transferred"]}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN55045256/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://freefrom.space/", "tags": ["x_transferred"]}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom", "tags": ["x_transferred"]}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN55045256/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:05.045Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36277", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-17T14:24:09.463816Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:*"], "vendor": "freefrom_kk", "product": "freefrom_the_nostr_client_app", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T14:25:39.606Z"}}], "cna": {"affected": [{"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for Android", "versions": [{"status": "affected", "version": "prior to 1.3.5"}]}, {"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for iOS", "versions": [{"status": "affected", "version": "prior to 1.3.5"}]}], "references": [{"url": "https://freefrom.space/"}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom"}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"url": "https://jvn.jp/en/jp/JVN55045256/"}], "descriptions": [{"lang": "en", "value": "Improper verification of cryptographic signature issue exists in \"FreeFrom - the nostr client\" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-17T07:33:55.100Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36277", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:37:05.045Z", "dateReserved": "2024-06-03T03:52:23.220Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-06-17T07:33:55.100Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}