Описание
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
The Mozilla Foundation Security Advisory describes this flaw as:
Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack.
Отчет
Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | ||
| Red Hat Enterprise Linux 7 | thunderbird | Fixed | RHSA-2023:1806 | 17.04.2023 |
| Red Hat Enterprise Linux 8 | thunderbird | Fixed | RHSA-2023:1802 | 17.04.2023 |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | thunderbird | Fixed | RHSA-2023:1803 | 17.04.2023 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | thunderbird | Fixed | RHSA-2023:1805 | 17.04.2023 |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service | thunderbird | Fixed | RHSA-2023:1805 | 17.04.2023 |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | thunderbird | Fixed | RHSA-2023:1805 | 17.04.2023 |
| Red Hat Enterprise Linux 8.4 Extended Update Support | thunderbird | Fixed | RHSA-2023:1804 | 17.04.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | thunderbird | Fixed | RHSA-2023:1811 | 17.04.2023 |
| Red Hat Enterprise Linux 9 | thunderbird | Fixed | RHSA-2023:1809 | 17.04.2023 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for Jav ...
Уязвимость набора средств разработки для JavaScript и TypeScript matrix-js-sdk, связанная с неконтролируемым изменением атрибутов прототипа объекта, позволяющая нарушителю вызвать отказ в обслуживании
7.5 High
CVSS3