Retained exploded messages in Keybase clients for macOS and Windows
CVE-2022-22779

3.7LOW

Key Information:

Vendor

Zoom
Status
Keybase Client For Mac OS
Keybase Client For Windows
Vendor
CVE Published:
9 February 2022

What is CVE-2022-22779?

The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.

Affected Version(s)

Keybase Client for macOS < 5.9.0

Keybase Client for Windows < 5.9.0

References

https://explore.zoom.us/en/trust/security/security-bulletin
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Olivia O'Hara
.