RUSTSEC-2022-0085

matrix-sdk Impersonation of room keys

Reported

September 29, 2022

Issued

February 2, 2023

Package

matrix-sdk-crypto (crates.io)

Type

Vulnerability

Aliases

CVE-2022-39252
GHSA-vp68-2wrm-69qm

Details

https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbb

CVSS Score

7.5 HIGH

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Patched

>=0.6.0

Description

When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack.