5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
49.5%
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.
Starting with version 17.1.0-rc.1, improperly formed beacon events can
disrupt or impede the matrix-js-sdk from functioning properly, potentially
impacting the consumer’s ability to process data safely. Note that the
matrix-js-sdk can appear to be operating normally but be excluding or
corrupting runtime data presented to the consumer. This is patched in
matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync
processor to store data, and restarting the client are possible
workarounds. Alternatively, redacting the applicable events and clearing
all storage will fix the further perceived issues. Downgrading to an
unaffected version, noting that such a version may be subject to other
vulnerabilities, will additionally resolve the issue.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
ubuntu | 22.04 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
ubuntu | 23.10 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
ubuntu | 18.04 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.18.04.1 | UNKNOWN |
ubuntu | 20.04 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.20.04.1 | UNKNOWN |
ubuntu | 22.04 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.22.04.1 | UNKNOWN |
ubuntu | 22.10 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.22.10.1 | UNKNOWN |
github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-hvv8-5v86-r45x
github.com/matrix-org/matrix-spec-proposals/pull/3488
launchpad.net/bugs/cve/CVE-2022-39236
nvd.nist.gov/vuln/detail/CVE-2022-39236
security-tracker.debian.org/tracker/CVE-2022-39236
ubuntu.com/security/notices/USN-5724-1
www.cve.org/CVERecord?id=CVE-2022-39236
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
49.5%