CVE-2022-45195
Medium
Description
SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.
SeverityMedium
CVSS5.3
Exploit probability—
ProductSimplex Chat
PublishedNov 12, 2022
First seenNov 12, 2022
Weakness typeCWE-327CWE-327
How to fix
Update
- simplex simplex_chat4.2 or later
- simplex simplexmq3.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplex simplex_chat | v < 4.2 | 4.2 |
| simplex simplexmq | v < 3.4.0 | 3.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.