Matrix Javascript Sdk vulnerabilities

CVE-2024-42369 [MEDIUM] CWE-674 CVE-2024-42369: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserve matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomCha

CVE-2023-29529 [MEDIUM] CWE-862 CVE-2023-29529: matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This at

CVE-2023-28427 [HIGH] CWE-1321 CVE-2023-28427: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operat

CVE-2022-36059 [MEDIUM] CWE-1321 CVE-2022-36059: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be oper

CVE-2022-39250 [HIGH] CWE-287 CVE-2022-39250: Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Pri Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other

CVE-2022-39251 [HIGH] CWE-287 CVE-2022-39251: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an at Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver

CVE-2022-39249 [HIGH] CWE-287 CVE-2022-39249: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an at Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the ma

CVE-2022-39236 [MEDIUM] CWE-20 CVE-2022-39236: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-r Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excludin

CVE-2021-44538 [CRITICAL] CWE-119 CVE-2021-44538: The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the re

CVE-2021-40823 [MEDIUM] CWE-290 CVE-2021-40823: A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) bef A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserv