CVE-2022-39254
Last modified
CVE-2022-39254 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Matrix-Nio Project | Matrix-Nio | < 0.20 |
References
- https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0Patch, Third Party Advisory
- https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffhThird Party Advisory
- https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0Patch, Third Party Advisory
- https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffhThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-39254?
How severe is CVE-2022-39254?
How do I fix CVE-2022-39254?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-39249Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…7.5
- CVE-2022-3925The buddybadges WordPress plugin through 1.0.0 does not sani…7.2
- CVE-2022-39250Matrix JavaScript SDK is the Matrix Client-Server software d…7.5
- CVE-2022-39251Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…7.5
- CVE-2022-39252matrix-rust-sdk is an implementation of a Matrix client-serv…7.5
- CVE-2022-39253Git is an open source, scalable, distributed revision contro…5.5
- CVE-2022-39255Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
- CVE-2022-39256Orckestra C1 CMS is a .NET based Web Content Management Syst…8
- CVE-2022-39257Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
- CVE-2022-39258mailcow is a mailserver suite. A vulnerability innversions p…8.2
- CVE-2022-39259jadx is a set of command line and GUI tools for producing Ja…5.5
- CVE-2022-3926The WP OAuth Server (OAuth Authentication) WordPress plugin …6.5
Are you affected by CVE-2022-39254?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST