CVE-2022-45195

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-12 · updated 2026-06-17
Weakness: CWE-327

Description

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.

Affected products

Simplex Chat: before 4.2 — fixed in 4.2
Simplexmq: before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: Simplex Chat 4.2; Simplexmq 3.4.0. Check the vendor advisory for mitigations.

References

https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0
https://github.com/simplex-chat/simplexmq/pull/548
https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf
https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html
https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0
https://github.com/simplex-chat/simplexmq/pull/548
https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf
https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html

Get alerted when CVE-2022-45195 or the next vulnerability affects your stack