CVE-2021-21387

The CVE-2021-21387 entry concerns the Wrongthink peer-to-peer, end-to-end encrypted messenger (using PeerJS and Axolotl ratchet). The documented issues include partial disclosure of the secret identity key via the fingerprint used for connections, and an improperly calculated safety number (deriv...

CVE-2021-21387 Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength

Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...