CVE-2022-39252
Assigner: GitHub_M
Published: 2022-09-29T14:15:14
State: PUBLISHED
affected: product: matrix-rust-sdk
vendor: matrix-org
versions: status: affected
version: < 0.6
descriptions: value: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-322
description: CWE-322: Key Exchange without Entity Authentication
type: CWE
descriptions: cweId: CWE-287
description: CWE-287: Improper Authentication
type: CWE
source: advisory: GHSA-vp68-2wrm-69qm
discovery: UNKNOWN
title: When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder