{"action":"Upgrade org.matrix.android:matrix-android-sdk2 to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"org.matrix.android:matrix-android-sdk2","cve_ids":["CVE-2022-39248"],"ecosystem":"Maven","epss":0.00996,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-fpgf-pjjv-2qgm","id":"tcs_01M5N8WFB1H257CSBAMY33EMVG","modified_at":"2023-11-08T04:10:16.510187Z","published_at":"2022-09-30T04:37:39Z","references":["https://osv.dev/vulnerability/GHSA-fpgf-pjjv-2qgm","https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-fpgf-pjjv-2qgm","https://nvd.nist.gov/vuln/detail/CVE-2022-39248","https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e","https://github.com/matrix-org/matrix-android-sdk2","https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1","https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-fpgf-pjjv-2qgm","url":"https://osv.dev/vulnerability/GHSA-fpgf-pjjv-2qgm"}],"summary":"matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion"}