Retained exploded messages in Keybase clients for Android and iOS

  • ZSB-21017
  • CVE-2021-34421
  • Low
  • 3.7
  • CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by a user if the receiving user places the chat session in the background while the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from the customer’s device.

Keybase addressed this issue in the 5.8.0 Keybase Client for Android and the 5.8.0 Keybase Client for iOS releases. Users can help keep themselves secure by applying current updates or downloading the latest Keybase software with all current security updates from https://zoom.us/download.

  • All Keybase Client for Android before version 5.8.0
  • All Keybase Client for iOS before version 5.8.0

Reported by Olivia O'Hara, John Jackson, Jackson Henry, and Robert Willis

Revision Date Description
1.0 11/09/2021

Initial Publication