CVE-2019-16992 - Improper Verification of Cryptographic Signature

Severity

75%

Complexity

39%

Confidentiality

60%

The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments to the user), which might be incompatible with a user's personal position on the semantics of an attestation.

CVSS 3.1 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N).

Demo Examples

Improper Verification of Cryptographic Signature

CWE-347

In the following code, a JarFile object is created from a downloaded file.


               JarFile jf = new JarFile(f);

The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.

Overview

First reported 5 years ago

2019-09-30 00:15:00

Last updated 5 years ago

2019-10-08 12:43:00

Affected Software

Keybase 2.13.2 for iPhone OS

2.13.2

iphone_os

References

https://github.com/keybase/keybase-issues/issues/3583

Third Party Advisory

https://sneak.berlin/20190929/keybase-backdoor/