Home > Vulnerability Database > CVE-2022-45195

Mend.io Vulnerability Database

CVE-2022-45195

Date: November 11, 2022

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.

Language: HASKELL

Severity Score

5.3

Related Resources (6)

Url: https://github.com/simplex-chat/simplexmq/pull/548

Url: https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html

Url: https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-45195

Url: https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf

Url: https://www.mend.io/vulnerability-database/CVE-2022-45195

Severity Score

5.3

Weakness Type (CWE)

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2022-45195

Date: November 11, 2022

Language: HASKELL

Severity Score

Related Resources (6)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?