CVE-2024-47080

npm/matrix-js-sdk CVE-2024-47080: high 8.7, EPSS 0.68%

Matrix JavaScript SDK's key history sharing could share keys to malicious devices

Action: Upgrade matrix-js-sdk to 34.8.0 or later.

npm i matrix-js-sdk@34.8.0

Affected

Fixed versions

Sources

• osv: GHSA-4jf8-g8wp-cx7c
• nvd: CVE-2024-47080
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-4jf8-g8wp-cx7c
• https://github.com/matrix-org/matrix-spec-proposals/pull/3061
• https://github.com/matrix-org/matrix-js-sdk/commit/2fb1e659c81f75253c047832dc9dcc2beddfac5f
• https://github.com/matrix-org/matrix-js-sdk

CVE-2024-47080 · published 2024-10-15T18:07:26Z · modified 2024-10-15T18:27:16.508712Z · JSON