Poljar

Name of the Vulnerable Software and Affected Versions: matrix-sdk-base versions prior to 0.14.1 Description: A panic can occur when calling the `RoomMember::normalized power level()` method if a room member has a power level of `Int::Min`. Recommendations: Update to version 0.14.1 or later.

Name of the Vulnerable Software and Affected Versions: matrix-sdk versions 0.11 through 0.12 Description: An SQL injection vulnerability exists in the `EventCache::find event with relations` method. This allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. Recommendations: Pass only trusted or sanitised relation types to the `filter` argument of the `EventCache::find event with relations()` method. Update to version 0.13.