CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29529 – matrix-js-sdk vulnerable to invisible eavesdropping in group calls
https://notcve.org/view.php?id=CVE-2023-29529
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. • https://github.com/matrix-org/matrix-js-sdk/releases/tag/v24.1.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q https://github.com/matrix-org/matrix-spec-proposals/pull/3401 • CWE-862: Missing Authorization •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28427 – Prototype pollution in matrix-js-sdk
https://notcve.org/view.php?id=CVE-2023-28427
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. • https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 https://security.gentoo.org/glsa/202305-36 https://www.debian.org/security/2023/dsa-5392 https://access.redhat.com/security/cve/CVE-2023-28427 https://bugzilla.redhat.com/show_bug.cgi?id=2183278 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39250 – Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
https://notcve.org/view.php?id=CVE-2022-39250
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. • https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-5w8r-8pgj-5jmf https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://security.gentoo.org/glsa/202210-35 https://access.redhat.com/security/cve/CVE-2022-39250 https://bugzilla.redhat.com/show_bug.cgi?id=21353 • CWE-287: Improper Authentication CWE-322: Key Exchange without Entity Authentication •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39249 – Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
https://notcve.org/view.php?id=CVE-2022-39249
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. • https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg https://github.com/matrix-org/matrix-spec-proposals/pull/3061 https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://security.gentoo.org/glsa/202210-35 https://access.redhat.com/security/cve/CVE • CWE-287: Improper Authentication CWE-322: Key Exchange without Entity Authentication •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39251 – Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
https://notcve.org/view.php?id=CVE-2022-39251
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. • https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://security.gentoo.org/glsa/202210-35 https://access.redhat.com/security/cve/CVE-2022-39251 https://bugzilla.redhat.com/show_bug.cgi?id=21353 • CWE-287: Improper Authentication CWE-322: Key Exchange without Entity Authentication •