CVE-2021-21387
Published: 19 March 2021
Summary
CVE-2021-21387 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Wrongthink Wrongthink. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-8691
Vulnerability details
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used…
more
for connection. Additionally, the safety number was improperly calculated. It was computed using part of one of the public identity keys instead of being derived from both public identity keys. This caused issues in computing safety numbers which would potentially be exploitable in the real world. Additionally there was inadequate encryption strength due to use of 1024-bit DSA keys. These issues are all fixed in version 2.3.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm.
Requires cryptography for transmission uses, eliminating cleartext exposure of sensitive data in transit.
Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.
Assessments identify and document improperly implemented security checks, allowing fixes that reduce exploitation of flawed checks.
By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.
Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.
Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.
Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.