What is CVE-2021-32755?

CVE-2021-32755 is a medium-severity vulnerability in Apple Iphone OS, classified under Improper Certificate Validation. CVSS score: 5.4/10. Published 2021-07-13.

How severe is CVE-2021-32755?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Apple Iphone OS

CVE-2021-32755

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.

Vulnerability class: Improper Certificate Validation

EPSS: 0.003 (23.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Apple Iphone_os
Wire
Wireapp Wire-ios-transport — versions = 3.8.2

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2021-32755?: CVE-2021-32755 is a medium-severity vulnerability in Apple Iphone OS, classified under Improper Certificate Validation. CVSS score: 5.4/10. Published 2021-07-13.
How severe is CVE-2021-32755?: Medium severity. CVSS v3 base score is 5.4 out of 10.