CVE-2021-41094 (published 2021-10-04T19:15Z)

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/wireapp/wire-ios
commit_details: repo_url: https://github.com/wireapp/wire-ios
author: Jacob Persson
author_date: 2021-04-16 11:00:50+02:00
msg: Merge pull request from GHSA-h4m7-pr8h-j7rf

* Show alert when logged out due to missing biometric passcode

* Update copy

* Revert strings file change

* Update copy
repository: repo_url: https://github.com/wireapp/wire-ios
repo_name: wireapp/wire-ios
description: 📱 Wire for iOS (iPhone and iPad)
repo_language: Swift
owner: wireapp
file_changes: filename: Strings+Generated.swift
change_type: ModificationType.MODIFY
diff: @@ -57,6 +57,12 @@ internal enum L10n {
         internal static let title = L10n.tr("Localizable", "about.website.title")
       }
     }
+    internal enum AccountDeletedMissingPasscodeAlert {
+      /// In order to use Wire, please set a passcode in your device settings.
+      internal static let message = L10n.tr("Localizable", "account_deleted_missing_passcode_alert.message")
+      /// No Device Passcode
+      internal static let title = L10n.tr("Localizable", "account_deleted_missing_passcode_alert.title")
+    }
     internal enum AccountDeletedSessionExpiredAlert {
       /// The application did not communicate with the server for a long period of time, or your session has been remotely invalidated.
       internal static let message = L10n.tr("Localizable", "account_deleted_session_expired_alert.message")

programming_language: Swift
filename: Localizable.strings
change_type: ModificationType.MODIFY
diff: @@ -1804,6 +1804,9 @@
 "account_deleted_session_expired_alert.title" = "Your session expired";
 "account_deleted_session_expired_alert.message" = "The application did not communicate with the server for a long period of time, or your session has been remotely invalidated.";
 
+"account_deleted_missing_passcode_alert.title" = "No device passcode";
+"account_deleted_missing_passcode_alert.message" = "In order to use Wire, please set a passcode in your device settings.";
+
 // Button cell state
 "button_message_cell.state.unselected" = "unselected";
 "button_message_cell.state.selected" = "selected";

programming_language: JavaScript
filename: AppRootRouter.swift
change_type: ModificationType.MODIFY
diff: @@ -445,8 +445,14 @@ extension AppRootRouter {
 
         switch reason {
         case .sessionExpired:
-            rootViewController.presentAlertWithOKButton(title: "account_deleted_session_expired_alert.title".localized,
-                                                        message: "account_deleted_session_expired_alert.message".localized)
+            rootViewController.presentAlertWithOKButton(
+                title: L10n.Localizable.AccountDeletedSessionExpiredAlert.title,
+                message: L10n.Localizable.AccountDeletedSessionExpiredAlert.message)
+
+        case .biometricPasscodeNotAvailable:
+            rootViewController.presentAlertWithOKButton(
+                title: L10n.Localizable.AccountDeletedMissingPasscodeAlert.title,
+                message: L10n.Localizable.AccountDeletedMissingPasscodeAlert.message)
 
         case .databaseWiped:
             let wipeCompletionViewController = WipeCompletionViewController()

programming_language: Swift