SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| simplex | simplex_chat | * |
| simplex | simplexmq | * |