CVE-2021-32665 Verified groups not reliable

What is CVE-2021-32665?

CVE-2021-32665 is a high-severity vulnerability in wireapp wire-ios, published on 3 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversation could be incorrectly set to "unverified. This occurs when: - Self user is added to a new conversation - Self user is added to an existing conversation - All the participants in the conversation were previously marked as verified. The vulnerability is patched in wire-ios version 3.8.1. As a workaround, one can unverify & verify a device in the conversation.

Weakness: CWE-345

Which versions are affected by CVE-2021-32665?

It affects 1 product.

Products include Wire Wire.

How do I fix CVE-2021-32665?

No fix has been published for CVE-2021-32665 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32665 being exploited?

There is no known exploitation of CVE-2021-32665 in the wild and no public exploit code.

Other vulnerabilities in wireapp wire-ios

• CVE-2020-27853 Other in n/a Critical 9.8
• CVE-2020-15258 Insecure use of shell.openExternal in Wire High 8.0
• CVE-2018-8909 Path traversal in n/a High 7.5
• CVE-2021-41093 Account takeover when having only access to a user's short lived token High 7.4
• CVE-2023-22737 wire-server vulnerable to unauthorized removal of Bots from Conversations Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mc3m-xwph-4h9h.