Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

"FreeFrom - the nostr client" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below. <ul><li>Improper verification of cryptographic signature (CWE-347) - CVE-2024-36277</li> <li>Reliance on obfuscation or encryption of security-relevant inputs without integrity checking (CWE-649) - CVE-2024-36279</li> <li>Reusing a nonce, key pair in encryption (CWE-323) - CVE-2024-36289</li></ul> The people listed below reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Hayato Kimura of University of Hyogo Ryoma Ito of National Institute of Information and Communications Technology (NICT) Kazuhiko Minematsu of NEC Corporation/Yokohama National University Takanori Isobe of University of Hyogo