CVE-2022-39252

2022-09-2915:15:10

CWE-287

CWE-322

[email protected]

web.nvd.nist.gov

matrix-rust-sdk

matrix

rust

matrix client-server

library

encryption

security

cve-2022-39252

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

38.0%

JSON

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.

Affected configurations

Vulners

NVD

Node

matrix-orgmatrix_rust_sdkRange<0.6

CPENameOperatorVersion
matrix:matrix-rust-sdkmatrix matrix-rust-sdklt0.6

CPE	Name	Operator	Version
matrix:matrix-rust-sdk	matrix matrix-rust-sdk	lt	0.6

CNA Affected

[
  {
    "product": "matrix-rust-sdk",
    "vendor": "matrix-org",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.6"
      }
    ]
  }
]