GitHub Advisoryadvisory · Maven

GHSA-jjmc-4p83-pp26 Logic error in Matrix SDK for Android

MEDIUM Published 2022-05-24 Modified 2023-08-09 Official page ↗
Aliases
CVE-2021-40824
Ecosystem
Maven
Packages
org.matrix.android:matrix-android-sdk2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-327
Reviewed
2023-08-09

Affected packages

• Maven org.matrix.android:matrix-android-sdk2: < 1.2.2 → fixed in 1.2.2

Description

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 leads to a situation where identity verification is inadequate and thus a key-requesting device can be impersonated.

Related

Alias · CVE (1)

  • CVE-2021-40824 A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android)… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References