DEBIAN-CVE-2024-47080

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

CVE-2024-47080

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

UBUNTU-CVE-2024-47080

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

@dstny/scp-sdk (>=2.0.0, <=3.0.0-rc3), @elizaos/plugin-matrix (>=2.0.0-alpha.3, <=2.0.0-alpha.8) +33 more potentially affected by CVE-2024-47080 via matrix-js-sdk (>=9.11.0, <=34.7.0)

matrix-js-sdk NPM version =9.11.0, =2.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =0.2.0, =0.0.14, =0.0.1, =0.0.0-development, =0.17.0, =4.0.1, =1.2.0, =0.1.14, =0.1.18, =0.2.4 - @zqbflynn/kernel 6.4.2 and more Source cves: CVE-2024-47080 Source advisory: MEND:CVE-2024-47080...

CVE-2024-47080

CVE-2024-47080 affects matrix-js-sdk (Matrix Client-Server SDK for JavaScript/TypeScript). In versions 9.11.0–34.7.0, MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers because it unconditionally sends shared history keys to all invited devices, regardless o...

CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

CVE-2024-47080

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method "MatrixClient.sendSharedHistoryKeys" is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used ...

CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

CVE-2024-47080: Exposure of Sensitive Information to an Unauthorized Actor

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

matrix-js-sdk information leakage vulnerability

matrix-js-sdk is an application component of Matrix open source. An information disclosure vulnerability exists in matrix-js-sdk, which stems from the MatrixClient.sendSharedHistoryKeys function being susceptible to interception by a malicious master server...

CentOS 7 : thunderbird (RHSA-2022:6710)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6710 advisory. - When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects...

PT-2024-7389 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0 Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share...

Uncontrolled Recursion

matrix-js-sdk is vulnerable to Uncontrolled Recursion. The vulnerability is caused due to an infinite recursion in getRoomUpgradeHistory function causing the code to hang. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle and also by calling...

matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Impact A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain' method, so...

GHSA-VHR5-G3PM-49FM matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Impact A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain' method, so...

matrix-react-sdk (>=3.102.0-rc.0, <=3.106.0) potentially affected by CVE-2024-42369 via matrix-js-sdk (>=34.0.0-rc.0, <=34.3.0)

matrix-js-sdk NPM version =34.0.0-rc.0, =3.102.0-rc.0, =3.106.0 Source cves: CVE-2024-42369 Source advisory: GHSA-VHR5-G3PM-49FM...

matrix-react-sdk (>=3.102.0-rc.0, <=3.106.0) potentially affected by CVE-2024-42369 via matrix-js-sdk (>=34.0.0-rc.0, <=34.3.0)

matrix-js-sdk NPM version =34.0.0-rc.0, =3.102.0-rc.0, =3.106.0 Source cves: CVE-2024-42369 Source advisory: OSV:GHSA-VHR5-G3PM-49FM...

CVE-2024-42369 A room with itself as a its predecessor will freeze matrix-js-sdk

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This...

CVE-2024-42369

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This...

@airgap/beacon-sdk (>=0.0.1-beta.0, <=0.3.0), @caelum-tech/lorena-matrix-client (>=1.3.0, <=2.1.2) +70 more potentially affected by CVE-2024-42369 via matrix-js-sdk (>=0.0.4, <=34.3.0)

matrix-js-sdk NPM version =0.0.4, =0.0.1-beta.0, =1.3.0, =1.0.0, =2.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =0.0.1, =0.0.14, =0.0.1, =2.10.1, =0.0.0-development, =0.17.0, =4.0.1, =4.0.2 and more Source cves: CVE-2024-42369 Source advisory: MEND:CVE-2024-42369...