JVNDB-2024-000060

Vulnerability from jvndb - Published: 2024-06-07 14:51 - Updated:2024-06-07 14:51
Severity ?
5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Multiple vulnerabilities in "FreeFrom - the nostr client" App
Details
"FreeFrom - the nostr client" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below.
  • Improper verification of cryptographic signature (CWE-347) - CVE-2024-36277
  • Reliance on obfuscation or encryption of security-relevant inputs without integrity checking (CWE-649) - CVE-2024-36279
  • Reusing a nonce, key pair in encryption (CWE-323) - CVE-2024-36289
The people listed below reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Hayato Kimura of University of Hyogo Ryoma Ito of National Institute of Information and Communications Technology (NICT) Kazuhiko Minematsu of NEC Corporation/Yokohama National University Takanori Isobe of University of Hyogo
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000060.html",
  "dc:date": "2024-06-07T14:51+09:00",
  "dcterms:issued": "2024-06-07T14:51+09:00",
  "dcterms:modified": "2024-06-07T14:51+09:00",
  "description": "\"FreeFrom - the nostr client\" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eImproper verification of cryptographic signature (CWE-347) - CVE-2024-36277\u003c/li\u003e\r\n\u003cli\u003eReliance on obfuscation or encryption of security-relevant inputs without integrity checking (CWE-649) - CVE-2024-36279\u003c/li\u003e\r\n\u003cli\u003eReusing a nonce, key pair in encryption (CWE-323) - CVE-2024-36289\u003c/li\u003e\u003c/ul\u003e\r\n\r\nThe people listed below reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nHayato Kimura of University of Hyogo\r\nRyoma Ito of National Institute of Information and Communications Technology (NICT)\r\nKazuhiko Minematsu of NEC Corporation/Yokohama National University\r\nTakanori Isobe of University of Hyogo",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000060.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:freefrom_android_app_freefrom-the_nostr_client",
      "@product": "\"FreeFrom - the nostr client\" App for Android",
      "@vendor": "FreeFrom K.K.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:freefrom_iOS_app_freefrom-the_nostr_client",
      "@product": "\"FreeFrom - the nostr client\" App for iOS",
      "@vendor": "FreeFrom K.K.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000060",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN55045256/index.html",
      "@id": "JVN#55045256",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36277",
      "@id": "CVE-2024-36277",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36279",
      "@id": "CVE-2024-36279",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-36289",
      "@id": "CVE-2024-36289",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in \"FreeFrom - the nostr client\" App"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.