CVE-2022-45195

Katalog CVE

CVSS 5.3 · Medium EPSS 0,62%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada simplex chat, simplexmq. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.

Rincian

Terbit di NVD

12 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html release notes · advisory vendor
• https://github.com/simplex-chat/simplexmq/pull/548 patch · advisory pihak ketiga
• https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0 release notes · advisory pihak ketiga
• https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf exploit · deskripsi teknis · advisory pihak ketiga