CVE-2021-40824

2021-09-1319:15:19

Google

osv.dev

logic error

room key sharing

element android

matrix android

encryption keys

matrix homeserver

crafted messages

end-to-end encryption

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

36.0%

JSON

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end encrypted messages sent by affected clients.