Vulnerability · Published Jun 17, 2024 · Assigned by jpcert
CVE-2024-36289
Medium 5.3
In plain English
A medium-severity security flaw in "FreeFrom - the nostr client" App for Android from FreeFrom K.K.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 85.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FreeFrom K.K. | "FreeFrom - the nostr client" App for Android | prior to 1.3.5 |
| FreeFrom K.K. | "FreeFrom - the nostr client" App for iOS | prior to 1.3.5 |
Weakness: CWE-323 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N