GitHub Advisoryadvisory · npm

GHSA-c7hh-3v6c-fj4q matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

LOW Published 2023-08-04 Modified 2023-08-04 Official page ↗
Aliases
CVE-2023-38700
Ecosystem
npm
Packages
matrix-appservice-irc
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-04

Affected packages

• npm matrix-appservice-irc: < 1.0.1 → fixed in 1.0.1

Description

Impact It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Patches Please upgrade to 1.0.1. Workarounds You can set the `matrixHandler.eventCacheSize` config value to `0` to workaround this bug. However, this may impact performance. Credits Discovered and reported by Val Lorentz. For more information If you have any questions or comments about this advisory email us at [email protected].

Related

Alias · CVE (1)

  • CVE-2023-38700 matrix-appservice-irc is a Node.js IRC bridge for Matrix. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References