CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
36.0%
A logic error in the room key sharing functionality of matrix-js-sdk (aka
Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver
present in an encrypted room to steal room encryption keys (via crafted
Matrix protocol messages) that were originally sent by affected Matrix
clients participating in that room. This allows the homeserver to decrypt
end-to-end encrypted messages sent by affected clients.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
ubuntu | 22.04 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
ubuntu | 24.04 | noarch | node-matrix-js-sdk | < any | UNKNOWN |
github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9 (v12.4.1)
github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1
launchpad.net/bugs/cve/CVE-2021-40823
matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing
matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing/
nvd.nist.gov/vuln/detail/CVE-2021-40823
security-tracker.debian.org/tracker/CVE-2021-40823
www.cve.org/CVERecord?id=CVE-2021-40823
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
36.0%