Maven/org.matrix.android:matrix-android-sdk2 CVE-2022-39248: high 8.6, EPSS 1.00%

matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion

Action: Upgrade org.matrix.android:matrix-android-sdk2 to 1.5.1 or later.

Affected

Fixed versions

Sources

• osv: GHSA-fpgf-pjjv-2qgm
• https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-fpgf-pjjv-2qgm
• https://nvd.nist.gov/vuln/detail/CVE-2022-39248
• https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e
• https://github.com/matrix-org/matrix-android-sdk2
• https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1
• https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

CVE-2022-39248 · published 2022-09-30T04:37:39Z · modified 2023-11-08T04:10:16.510187Z · JSON