GitHub Advisoryadvisory · Go

GHSA-pfw4-xjgm-267c Dendrite signature checks not applied to some retrieved missing events

HIGH Published 2022-09-15 Modified 2022-09-15 Official page ↗
Aliases
CVE-2022-39200
Ecosystem
Go
Packages
github.com/matrix-org/dendrite
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-347
Reviewed
2022-09-15

Affected packages

• Go github.com/matrix-org/dendrite: < 0.9.8 → fixed in 0.9.8

Description

Impact Events retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. Patches The problem has been fixed in Dendrite 0.9.8. Workarounds There are no workarounds. Special thanks Tulir Asokan, who spotted the issue originally.

Related

Alias · CVE (1)

  • CVE-2022-39200 Dendrite is a Matrix homeserver written in Go. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References