Libsignal Service Rs
Approved changes feed: RSS · Atom
cpe:2.3:a:whisperfish:libsignal-service-rs:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Whisperfish (158d5354-a137-5bc9-a1b7-13d14775bdd4) |
|---|---|
| Product | Libsignal Service Rs (794b0047-1bb7-5cdc-a234-218e00ce7a4c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-24904 |
vulnerable | 2026-06-08 07:12:50.149859 |
libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked
HIGH (8.5)
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and may have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.
Published: 2025-02-13T15:24:20.246Z
Updated: 2025-02-13T16:25:36.777Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24903 |
vulnerable | 2026-06-08 07:12:50.149528 |
libsignal-service-rs Doesn't Check Origin of Sync Messages
HIGH (8.5)
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user. The origin of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.
Published: 2025-02-13T15:20:28.251Z
Updated: 2025-02-13T16:27:04.294Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.