CVE-2024-36289 - Vulnerability Details - OpenCVE

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
https://freefrom.space/
https://jvn.jp/en/jp/JVN55045256/
https://play.google.com/store/apps/details?id=com.freefrom

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-06-17T07:34:25.793Z

Updated: 2024-08-02T03:37:05.005Z

Reserved: 2024-06-03T03:52:22.331Z

Link: CVE-2024-36289

Vulnrichment

Updated: 2024-08-02T03:37:05.005Z

NVD

Status : Awaiting Analysis

Published: 2024-06-17T08:15:49.063

Modified: 2024-11-21T09:21:59.813

Link: CVE-2024-36289

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36289", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-06-03T03:52:22.331Z", "datePublished": "2024-06-17T07:34:25.793Z", "dateUpdated": "2024-08-02T03:37:05.005Z"}, "containers": {"cna": {"affected": [{"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for Android", "versions": [{"version": "prior to 1.3.5", "status": "affected"}]}, {"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for iOS", "versions": [{"version": "prior to 1.3.5", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Reusing a nonce, key pair in encryption issue exists in \"FreeFrom - the nostr client\" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack."}], "problemTypes": [{"descriptions": [{"description": "Reusing a nonce, key pair in encryption", "lang": "en", "type": "text"}]}], "references": [{"url": "https://freefrom.space/"}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom"}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"url": "https://jvn.jp/en/jp/JVN55045256/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-17T07:34:25.793Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-323", "lang": "en", "description": "CWE-323 Reusing a Nonce, Key Pair in Encryption"}]}], "affected": [{"vendor": "freefrom_kk", "product": "freefrom_the_nostr_client_app", "cpes": ["cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.3.5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-18T16:31:01.878703Z", "id": "CVE-2024-36289", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T16:31:05.243Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:05.005Z"}, "title": "CVE Program Container", "references": [{"url": "https://freefrom.space/", "tags": ["x_transferred"]}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom", "tags": ["x_transferred"]}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN55045256/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://freefrom.space/", "tags": ["x_transferred"]}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom", "tags": ["x_transferred"]}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN55045256/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:05.005Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36289", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-18T16:31:01.878703Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:*"], "vendor": "freefrom_kk", "product": "freefrom_the_nostr_client_app", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-323", "description": "CWE-323 Reusing a Nonce, Key Pair in Encryption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T16:24:41.024Z"}}], "cna": {"affected": [{"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for Android", "versions": [{"status": "affected", "version": "prior to 1.3.5"}]}, {"vendor": "FreeFrom K.K.", "product": "\"FreeFrom - the nostr client\" App for iOS", "versions": [{"status": "affected", "version": "prior to 1.3.5"}]}], "references": [{"url": "https://freefrom.space/"}, {"url": "https://play.google.com/store/apps/details?id=com.freefrom"}, {"url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"url": "https://jvn.jp/en/jp/JVN55045256/"}], "descriptions": [{"lang": "en", "value": "Reusing a nonce, key pair in encryption issue exists in \"FreeFrom - the nostr client\" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Reusing a nonce, key pair in encryption"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-17T07:34:25.793Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36289", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:37:05.005Z", "dateReserved": "2024-06-03T03:52:22.331Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-06-17T07:34:25.793Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Reusing a nonce, key pair in encryption issue exists in \"FreeFrom - the nostr client\" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack."}, {"lang": "es", "value": "Existe un problema de reutilizaci\u00f3n de un par de claves nonce en el cifrado en las versiones de la aplicaci\u00f3n \"FreeFrom - the nostr client\" anteriores a la 1.3.5 para Android e iOS. Si se explota esta vulnerabilidad, el contenido de los mensajes directos (DM) entre usuarios puede ser manipulado mediante un ataque de intermediario."}], "id": "CVE-2024-36289", "lastModified": "2024-11-21T09:21:59.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-17T08:15:49.063", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"source": "vultures@jpcert.or.jp", "url": "https://freefrom.space/"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN55045256/"}, {"source": "vultures@jpcert.or.jp", "url": "https://play.google.com/store/apps/details?id=com.freefrom"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://freefrom.space/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://jvn.jp/en/jp/JVN55045256/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://play.google.com/store/apps/details?id=com.freefrom"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-323"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}