Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-39264
HistorySep 28, 2022 - 12:00 a.m.

CVE-2022-39264

2022-09-2800:00:00
ubuntu.com
ubuntu.com
28
nheko
desktop client
upgrade
cve-2022-39264
matrix communication application
vulnerability
man-in-the-middle
patch
workaround
settings menu
unix

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS

0.001

Percentile

45.5%

nheko is a desktop client for the Matrix communication application. All
versions below 0.10.2 are vulnerable homeservers inserting malicious
secrets, which could lead to man-in-the-middle attacks. Users can upgrade
to version 0.10.2 to protect against this issue. As a workaround, one may
apply the patch manually, avoid doing verifications of one’s own devices,
and/or avoid pressing the request button in the settings menu.

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS

0.001

Percentile

45.5%