Christian Bundy

**Name of the Vulnerable Software and Affected Versions** SSB-DB version 20.0.0 SSB-Server version 16.0.0 **Description** The issue is an information disclosure vulnerability. The `get()` method is supposed to only decrypt messages when explicitly asked to, but there is a bug where it decrypts any message that it can. This means that it returns the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO, which exposes a thin wrapper around `get()` to anonymous peers. **Recommendations** For SSB-DB version 20.0.0, upgrade to version 20.0.1 immediately. For SSB-Server version 16.0.0, upgrade to version 16.0.1 to get the fixed version of SSB-DB. As a temporary workaround, consider disabling the SSB-OOO plugin to disable the most obvious attack vector.

**Name of the Vulnerable Software and Affected Versions** Oasis versions prior to 2.15.0 **Description** The issue concerns a potential DNS rebinding or CSRF vulnerability. If an attacker can trick a user into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read or write to vulnerable applications. There is no evidence that suggests this has been used in the wild. **Recommendations** For Oasis versions prior to 2.15.0, update to version 2.15.0 to resolve the issue. As a temporary workaround, consider avoiding visits to potentially malicious websites to minimize the risk of exploitation.