CVE-2023-33982
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Bramble Handshake Protocol (BHP) in Briar before version 1.5.3 is not forward secure, allowing eavesdroppers to decrypt network traffic between two accounts if they later compromise both accounts.
Risk Assessment
The risk to the organization involves the potential for decrypted communications, which could lead to the exposure of sensitive information, although eavesdropping is typically impractical due to the encrypted session using the Tor hidden service protocol.
Recommendation
It is recommended to upgrade to Briar version 1.5.3 or later to ensure forward security and minimize the risk of eavesdropping.
Original NVD description (English source)
Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later compromise both accounts. NOTE: the eavesdropping is typically impractical because BHP runs over an encrypted session that uses the Tor hidden service protocol.