Medium severity · published Mar 11, 2022
CVE-2022-23625
Wire-ios is a messaging application using the wire protocol on apple's ios platform
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wire · Wire
before 3.95 · source: NVD
WI
Wire-ios-transport · Wire
before 84.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23625
Patch
https://github.com/wireapp/wire-ios-transport/commit/02e90aa45edaf7eb2d8b97fa2377cd8104274170
Patch
https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-3xvh-x964-572h
Third Party Advisory
https://github.com/wireapp/wire-ios/security/advisories/GHSA-rq36-8qfp-79mc
More from Wire
9.8
CVE-2021-41093
Wire is an open source secure messenger
9.8
CVE-2020-27853
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string
8.0
CVE-2020-15258
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL
7.5
CVE-2018-8909
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to…
6.5
CVE-2023-22737
wire-server provides back end services for Wire, a team communication and collaboration platform