CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29529 – matrix-js-sdk vulnerable to invisible eavesdropping in group calls
https://notcve.org/view.php?id=CVE-2023-29529
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. • https://github.com/matrix-org/matrix-js-sdk/releases/tag/v24.1.0 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q https://github.com/matrix-org/matrix-spec-proposals/pull/3401 • CWE-862: Missing Authorization •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36060 – Prototype pollution in matrix-react-sdk
https://notcve.org/view.php?id=CVE-2022-36060
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28103 – Prototype pollution in matrix-react-sdk
https://notcve.org/view.php?id=CVE-2023-28103
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue. • https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28427 – Prototype pollution in matrix-js-sdk
https://notcve.org/view.php?id=CVE-2023-28427
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. • https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 https://security.gentoo.org/glsa/202305-36 https://www.debian.org/security/2023/dsa-5392 https://access.redhat.com/security/cve/CVE-2023-28427 https://bugzilla.redhat.com/show_bug.cgi?id=2183278 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41952 – Uncontrolled Resource Consumption in Matrix Synapse
https://notcve.org/view.php?id=CVE-2022-41952
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. • https://github.com/matrix-org/synapse/pull/11784 https://github.com/matrix-org/synapse/pull/11936 https://github.com/matrix-org/synapse/releases/tag/v1.52.0 https://github.com/matrix-org/synapse/releases/tag/v1.53.0 https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h • CWE-400: Uncontrolled Resource Consumption CWE-772: Missing Release of Resource after Effective Lifetime •