CVE-2022-39264

2022-09-2822:15:14

Google

osv.dev

nheko desktop client

cve-2022-39264

vulnerability

man-in-the-middle

upgrade

patch

workaround

settings menu

security fix

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

45.5%

JSON

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one’s own devices, and/or avoid pressing the request button in the settings menu.