matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
概要
matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate
the sender of an encrypted event. Accordingly, a malicious homeserver operator
can modify events served to clients, making those events appear to the recipient
as if they were sent by another user.
Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we
consider this a High severity security issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory rustsec.org
- package crates.io
- web github.com