Critical severity · published Oct 5, 2019
CVE-2019-17192
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which…
9.8
CVSS
2.7%
EPSS
No
On KEV
Description
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Private Messenger · Signal
through 4.47.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17192
Third Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1936
Third Party Advisory
https://news.ycombinator.com/item?id=21161432
Third Party Advisory
https://twitter.com/moxie/status/1180226374851710976
More from Private Messenger
7.5
CVE-2019-17191
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message
6.5
CVE-2019-9970
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when…
5.3
CVE-2020-5753
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to…
4.7
CVE-2018-3988
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then…