CVE-2021-40823
1 advisory.
npm/matrix-js-sdk CVE-2021-40823: medium 5.9, EPSS 0.66%
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
Action: Upgrade matrix-js-sdk to 12.4.1 or later.
npm i matrix-js-sdk@12.4.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 12.4.1 | - |
Fixed versions
| 12.4.1 |
Sources
- osv: GHSA-23cm-x6j7-6hq3
- https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-23cm-x6j7-6hq3
- https://nvd.nist.gov/vuln/detail/CVE-2021-40823
- https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9
- https://github.com/matrix-org/matrix-js-sdk
- https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1
- https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing
CVE-2021-40823 · published · modified · JSON