CVE-2021-21387

Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connection. Additionally, the safety number was improperly calculated. It was computed using part of one of the public identity keys instead of being derived from both public identity keys. This caused issues in computing safety numbers which would potentially be exploitable in the real world. Additionally there was inadequate encryption strength due to use of 1024-bit DSA keys. These issues are all fixed in version 2.3.0.

Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connection. Additionally, the safety number was improperly calculated. It was computed using part of one of the public identity keys instead of being derived from both public identity keys. This caused issues in computing safety numbers which would potentially be exploitable in the real world. Additionally there was inadequate encryption strength due to use of 1024-bit DSA keys. These issues are all fixed in version 2.3.0.

Wrongthink mensajero cifrado punto a punto y de extremo a extremo con PeerJS y Axolotl Ratchet. En wrongthink desde versión 2.0.0 y anteriores a 2.3.0, había un conjunto de vulnerabilidades que causaban una fuerza de cifrado inapropiada. Parte de la clave de identidad secreta fue divulgada por la huella digital usada para la conexión. Además, el número de seguridad fue calculado inapropiadamente. Se calculó usando parte de una de las claves de identidad públicas en lugar de derivarse de ambas claves de identidad públicas. Esto causó problemas en el cálculo de números de seguridad que potencialmente podrían explotarse en el mundo real. Además, hubo un nivel de cifrado inadecuado debido al uso de claves DSA de 1024 bits. Todos estos problemas están corregidos en versión 2.3.0