CVE-2022-39254

2022-09-2915:15:10

CWE-287

CWE-322

[email protected]

web.nvd.nist.gov

matrix-nio

python

matrix client

library

impersonation attack

cve-2022-39254

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.

Affected configurations

Vulners

NVD

Node

poljarmatrix_nioRange<0.20

CPENameOperatorVersion
matrix-nio_project:matrix-niomatrix-nio project matrix-niolt0.20

CPE	Name	Operator	Version
matrix-nio_project:matrix-nio	matrix-nio project matrix-nio	lt	0.20

CNA Affected

[
  {
    "product": "matrix-nio",
    "vendor": "poljar",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.20"
      }
    ]
  }
]