CVE-2021-32666 Asset DoS vulnerability
An attacker can cause the Wire iOS client to crash by providing a profile picture with a specific invalid asset ID containing a quote character.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32666?
CVE-2021-32666 is a medium-severity denial of service vulnerability in wireapp wire-ios, published on 3 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile picture and it contains the " character, it will cause the iOS client to crash. The vulnerability is patched in wire-ios version 3.8.1.
Weakness: CWE-20
Which versions are affected by CVE-2021-32666?
It affects 1 product.
Products include Wire Wire.
How do I fix CVE-2021-32666?
No fix has been published for CVE-2021-32666 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-32666 being exploited?
There is no known exploitation of CVE-2021-32666 in the wild and no public exploit code.
Other vulnerabilities in wireapp wire-ios
Sources
Also known as GHSA-mfcq-jg4v-2679.