CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39251 – Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
https://notcve.org/view.php?id=CVE-2022-39251
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. • https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://security.gentoo.org/glsa/202210-35 https://access.redhat.com/security/cve/CVE-2022-39251 https://bugzilla.redhat.com/show_bug.cgi?id=21353 • CWE-287: Improper Authentication CWE-322: Key Exchange without Entity Authentication •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-39236 – Matrix Javascript SDK improper beacon events can cause availability issues
https://notcve.org/view.php?id=CVE-2022-39236
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. • https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-hvv8-5v86-r45x https://github.com/matrix-org/matrix-spec-proposals/pull/3488 https://security.gentoo.org/glsa/202210-35 https://access.redhat.com/security/cve/CVE-2022-39236 https://bugzilla.redhat.com/show_bug.cgi?id=2135391 • CWE-20: Improper Input Validation •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36059 – Prototype pollution in matrix-js-sdk
https://notcve.org/view.php?id=CVE-2022-36059
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. • https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32 https://access.redhat.com/security/cve/CVE-2022-36059 https://bugzilla.redhat.com/show_bug.cgi?id=2123258 • CWE-440: Expected Behavior Violation CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-44538
https://notcve.org/view.php?id=CVE-2021-44538
The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. • https://gitlab.matrix.org/matrix-org/olm/-/tags https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk https://www.debian.org/security/2022/dsa-5034 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40823
https://notcve.org/view.php?id=CVE-2021-40823
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients. Un error lógico en la funcionalidad de compartición de claves de sala de matrix-js-sdk (también conocido como Matrix Javascript SDK) antes de la versión 12.4.1 permite que un servidor doméstico de Matrix malicioso presente en una sala cifrada robe las claves de cifrado de la sala (a través de mensajes de protocolo de Matrix manipulados) que fueron enviados originalmente por los clientes de Matrix afectados que participan en esa sala. Esto permite al servidor doméstico descifrar los mensajes cifrados de extremo a extremo enviados por los clientes afectados.e dispositivo • https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1 https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing • CWE-290: Authentication Bypass by Spoofing •