Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
mmit number 68948017423a12786704e54227b8b2f918c2fd27 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw - https://github.com/rizinorg/rizin/issues/2963 - https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27 - https://security.gentoo.org/glsa/202209-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE ID: CVE-2022-36041 State: PUBLISHED Published: 2022-09-06T00:00:00.000Z Last Updated: 2025-04-23T17:31:58.176Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rizinorg Products: rizin Problem Types: CWE-787 Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP
7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m - https://github.com/rizinorg/rizin/issues/2956 - https://github.com/rizinorg/rizin/commit/7323e64d68ecccfb0ed3ee480f704384c38676b2 - https://security.gentoo.org/glsa/202209-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE ID: CVE-2022-36042 State: PUBLISHED Published: 2022-09-06T00:00:00.000Z Last Updated: 2025-04-23T17:31:50.742Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rizinorg Products: rizin Problem Types: CWE-787 Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch. Additional Analyst Notes: - CVE Program Con
ne. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-pf72-jg54-8gvp - https://github.com/rizinorg/rizin/commit/556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 - https://security.gentoo.org/glsa/202209-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE ID: CVE-2022-36043 State: PUBLISHED Published: 2022-09-06T00:00:00.000Z Last Updated: 2025-04-23T17:31:41.570Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rizinorg Products: rizin Problem Types: CWE-415 Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch fo
tacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-rjhv-mj4g-j4p5 - https://github.com/rizinorg/rizin/issues/2964 - https://github.com/rizinorg/rizin/commit/a3d50c1ea185f3f642f2d8180715f82d98840784 - https://security.gentoo.org/glsa/202209-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE ID: CVE-2022-36044 State: PUBLISHED Published: 2022-09-06T00:00:00.000Z Last Updated: 2025-04-23T17:31:33.684Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rizinorg Products: rizin Problem Types: CWE-787 Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue. Addit
07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q - https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd - https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 - https://security.gentoo.org/glsa/202209-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE ID: CVE-2022-36045 State: PUBLISHED Published: 2022-08-31T15:10:09.000Z Last Updated: 2025-04-23T17:47:10.412Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NodeBB Products: NodeBB Problem Types: CWE-330, CWE-338 Description: NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially c
lier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the
specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NodeBB/NodeBB/security/advisories/GHSA-p4cc-w597-6cpm - https://github.com/NodeBB/NodeBB/commit/81e3c1ba488d03371a5ce8d0ebb5c5803026e0f9 - https://github.com/NodeBB/NodeBB/commit/e802fab87f94a13f397f04cfe6068f2f7ddf7888
CVE ID: CVE-2022-36046 State: PUBLISHED Published: 2022-08-31T18:55:09.000Z Last Updated: 2025-04-23T17:47:01.683Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: vercel Products: next.js Problem Types: CWE-248 Description: Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along wit
s/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3 - https://github.com/vercel/next.js/releases/tag/v12.2.4
CVE ID: CVE-2022-36048 State: PUBLISHED Published: 2022-08-31T19:15:11.000Z Last Updated: 2025-04-23T17:46:52.591Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-436 Description: Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser
embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452
CVE ID: CVE-2022-36049 State: PUBLISHED Published: 2022-09-07T20:15:13.000Z Last Updated: 2025-04-23T17:14:00.853Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: fluxcd Products: flux2 Problem Types: CWE-400 Description: Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In
l v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fluxcd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3 - https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxh
cd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3 - https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxh - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44996 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48360
CVE ID: CVE-2022-36051 State: PUBLISHED Published: 2022-08-31T22:40:10.000Z Last Updated: 2025-04-23T17:33:14.632Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-436 Description: ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login. **Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorizatio
mple, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organizations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability. There is currently no known workaround, users should update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-c8fj-4pm8-mp2c - https://github.com/zitadel/zitadel/releases/tag/v1.87.1 - https://github.com/zitadel/zitadel/releases/tag/v2.2.0
CVE ID: CVE-2022-36052 State: PUBLISHED Published: 2022-09-01T12:05:11.000Z Last Updated: 2025-04-23T17:32:59.826Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-125 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may cast a UDP header structure at a certain offset in a packet buffer. The code does not check whether the packet buffer is large enough to fit a full UDP header structure from the offset where the casting is made. Hence, it is possible to cause an out-of-bounds read beyond the packet buffer. The
he offset where the casting is made. Hence, it is possible to cause an out-of-bounds read beyond the packet buffer. The problem affects anyone running devices with Contiki-NG versions previous to 4.8, and which may receive 6LoWPAN packets from external parties. The problem has been patched in Contiki-NG version 4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/pull/1648 - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-vwr8-6mqv-x7f5
CVE ID: CVE-2022-36053 State: PUBLISHED Published: 2022-09-01T12:00:15.000Z Last Updated: 2025-04-23T17:33:06.634Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-125 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expecte
sts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bounds checking, the casting can be done so that the structure extends beyond the packet's end. Hence, with a carefully crafted packet, it is possible to cause the Contiki-NG system to read data outside the packet buffer. A patch that fixes the vulnerability is included in Contiki-NG 4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-2j9c-7754-w4cw - https://github.com/contiki-ng/contiki-ng/pull
github.com/contiki-ng/contiki-ng/security/advisories/GHSA-2j9c-7754-w4cw - https://github.com/contiki-ng/contiki-ng/pull/1648
CVE ID: CVE-2022-36054 State: PUBLISHED Published: 2022-09-01T12:10:11.000Z Last Updated: 2025-04-23T17:32:52.792Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-787 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be explo
heck in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/pull/1648 - https://github.com/contiki-ng/contiki-ng/security/ad
References: - https://github.com/contiki-ng/contiki-ng/pull/1648 - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-c36p-vhwg-244c
CVE ID: CVE-2022-36055 State: PUBLISHED Published: 2022-09-01T12:15:13.000Z Last Updated: 2025-04-23T17:32:44.520Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: helm Products: helm Problem Types: CWE-400 Description: Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_ package contains a parser that turns strings in to Go structures. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be creat
converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic. Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been resolved in 3.9.4. SDK users can validate strings supplied by users won't create large arrays causing significant m
been resolved in 3.9.4. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxh - https://github.com/helm/helm/releases/tag/v3.9.4
CVE ID: CVE-2022-36056 State: PUBLISHED Published: 2022-09-14T19:50:09.000Z Last Updated: 2025-04-22T17:21:40.980Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: sigstore Products: cosign Problem Types: CWE-347 Description: Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, w
crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues. Additional Analyst Notes: - C
. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388 - https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25
CVE ID: CVE-2022-36057 State: PUBLISHED Published: 2022-09-06T19:30:14.000Z Last Updated: 2025-04-23T17:14:30.715Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: discourse Products: discourse-chat Problem Types: CWE-80, CWE-79 Description: Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-chat/security/advisories/GHSA-3vf2-wrjx-p6xj - https://github.com/discourse/discourse-chat/pull/1205
CVE ID: CVE-2022-36058 State: PUBLISHED Published: 2022-09-06T20:10:09.000Z Last Updated: 2025-04-22T17:24:22.746Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ElrondNetwork Products: elrond-go Problem Types: CWE-20 Description: Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known wor
ing, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-qf7j-25g9-r63f - https://github.com/ElrondNetwork/elrond-go/commit/cb487fd7be2a2077638eb34ae771a73630c870c7 - https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L402
CVE ID: CVE-2022-36059 State: PUBLISHED Published: 2023-03-28T20:32:18.422Z Last Updated: 2025-02-18T20:05:37.448Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: matrix-org Products: matrix-js-sdk Problem Types: CWE-1321 Description: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consum
he matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32