Go/github.com/matrix-org/gomatrixserverlib CVE-2022-36009: medium 5, EPSS 0.83%

gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth

Action: Upgrade github.com/matrix-org/gomatrixserverlib to 0.0.0-20220815091947-723fd495dde8 or later.

go get github.com/matrix-org/gomatrixserverlib@v0.0.0-20220815091947-723fd495dde8

Affected

Fixed versions

Sources

• osv: GHSA-grvv-h2f9-7v9c#Go/github.com/matrix-org/gomatrixserverlib
• https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c
• https://nvd.nist.gov/vuln/detail/CVE-2022-36009
• https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575
• https://github.com/matrix-org/gomatrixserverlib
• https://matrix.org/docs/guides/moderation/#power-levels
• https://pkg.go.dev/vuln/GO-2022-0952

CVE-2022-36009 · published 2022-08-30T19:54:34Z · modified 2023-11-08T04:09:57.073105Z · JSON