POJIA破甲
地图 / End to end encryption public key is not properly verified on Desktop and Android

End to end encryption public key is not properly verified on Desktop and Android

密码学缺陷 / Unlabeled / #1189162

厂商
Nextcloud
严重程度
低危
赏金
$1,500
弱点
Unlabeled
研究员
@rtod
披露日期
2021-09-23
资产
Desktop Client
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1656 字符中的一小部分)
Since last time when I reported something on multiple platforms you seems to prefer handling it in 1 spot. I now just do one. Let me know if You want me to fill separate for android as well. This issue does not seem to happen on iOS as there a test string is encrypted and decrypted, in short …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @rtod · 版权归作者与 Nextcloud 所有

同类报告

WannaCrypt “Killswitch”HackerOne · 2017-05-13[Java] CWE-326: Query to detect weak encryption with an insufficient key sizeGitHub Security Lab · — · $4,500sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txsetMonero · 2026-09-17Use of Cryptographically Weak Pseudo-Random Number Generator in WebCrypto keygenInternet Bug Bounty · 2023-04-09 · $4,000Exposed Unencrypted Telnet EndpointStarbucks · 2017-02-08Android app does not clear end to end encryption keysNextcloud · 2021-06-16 · $100