PT-2023-2100 · Unknown+5 · Matrix-Js-Sdk+5

Denis Kasak · Publicado 2023-03-28 · Atualizado 2024-06-15 · CVE-2023-28427

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions matrix-js-sdk versions prior to 24.0.0

Description The issue is related to events sent with special strings in key places, which can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. The matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is a distinct issue from others that may cover similar problems.

Recommendations For versions prior to 24.0.0, upgrade to version 24.0.0 or later to resolve the issue. There are no known workarounds for this vulnerability.

Exploit

Correção

DoS

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

ALSA-2023:1802

ALSA-2023:1809

BDU:2023-01835

CESA-2023_1802

CESA-2023_1806

CVE-2023-28427

DLA-3400-1

DSA-5392-1

GHSA-MWQ8-FJPF-C2GR

MGASA-2023-0132

OPENSUSE-SU-2024:12823-1

OPENSUSE-SU-2024:12852-1

RHSA-2023:1802

RHSA-2023:1803

RHSA-2023:1804

RHSA-2023:1805

RHSA-2023:1806

RHSA-2023:1809

RHSA-2023:1810

RHSA-2023:1811

RHSA-2023_1802

RHSA-2023_1806

RHSA-2023_1809

RLSA-2023:1802

RLSA-2023:1809

SUSE-SU-2023:1736-1

Produtos afetados

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Matrix-Js-Sdk

Referências · 110

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28427.json · Exploit
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32 · Nota
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr · Aviso do Fabricante
• https://github.com/matrix-org/matrix-js-sdk · Nota
• https://security.gentoo.org/glsa/202305-36 · Nota
• https://suse.com/security/cve/CVE-2023-28164 · Nota
• https://cve.org/CVERecord?id=CVE-2023-28427 · Nota de Segurança
• https://bugzilla.suse.com/1209173 · Nota
• https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html · Nota
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 · Aviso do Fabricante
• https://debian.org/security/2023/dsa-5392 · Aviso do Fabricante
• https://bugzilla.redhat.com/2186104 · Nota
• https://access.redhat.com/security/cve/CVE-2023-29536 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28427 · Aviso do Fabricante
• https://bugzilla.redhat.com/2186111 · Nota