CVE-2022-39251

npm/matrix-js-sdk CVE-2022-39251: high 8.6, EPSS 1.18%

matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Action: Upgrade matrix-js-sdk to 19.7.0 or later.

npm i matrix-js-sdk@19.7.0

Affected

Fixed versions

Sources

• osv: GHSA-r48r-j8fx-mq2c
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c
• https://nvd.nist.gov/vuln/detail/CVE-2022-39251
• https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
• https://github.com/matrix-org/matrix-js-sdk
• https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
• https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
• https://security.gentoo.org/glsa/202210-35

CVE-2022-39251 · published 2022-09-30T00:41:24Z · modified 2023-11-08T04:10:16.694857Z · JSON