matrix-js-sdk 安全漏洞

matrix-js-sdk is an application component of matrix open source. A security vulnerability exists in matrix-js-sdk versions prior to 19.4.0, which stems from an event sent using a special string in a critical location may temporarily interrupt or prevent matrix-js-sdk from functioning properly...

Matrix clients -- several vulnerabilities

Matrix developers report: Today we are releasing security updates to libolm, matrix-js-sdk, and several clients including Element Web / Desktop. Users are encouraged to upgrade as soon as possible. These releases mitigate a buffer overflow in olmsessiondescribe, a libolm debugging function used b...

matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

Impact A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-en...

@rocket.chat/hubot-freddie (=0.0.7), almond-cmdline (>=1.1.0 <=1.8.0-beta.1) +18 more potentially affected by CVE-2021-40823 via matrix-js-sdk (>=0.0.4 <=12.4.0)

matrix-js-sdk NPM version =0.0.4, =1.1.0, =0.1.6, =0.1.11, =0.0.1, =1.0.33, =0.0.2, =0.1.0, =0.0.1, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2021-40823 Source advisory: OSV:GHSA-23CM-X6J7-6HQ3...

Privilege Escalation

matrix-js-sdk is vulnerable to privilege escalation. The vulnerability exists due to lack of identity verification which allows a key-requesting device to be impersonated...

CVE-2021-40823

A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were originally sent by affected Matrix clients...

CVE-2021-40823

CVE-2021-40823 affects matrix-js-sdk and related Element client variants. A logic error in the room key sharing functionality prior to version 12.4.1 allows a malicious Matrix homeserver participating in an encrypted room to steal room encryption keys originally sent by affected clients, enabling...

PT-2021-22960 · Cinny +5 · Cinny +7

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 12.4.1 Element Web versions 1.8.2 and earlier Element Desktop versions 1.8.2 and earlier SchildiChat Web versions 1.7.32-sc1 and earlier SchildiChat Desktop versions 1.7.32-sc1 and earlier Cinny versions 1.2.0...