high7.3
CVE-2022-39200
Dendrite signature checks not applied to some retrieved missing events
Impact
### Impact Events retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. ### Patches The problem has been fixed in Dendrite 0.9.8. ### Workarounds There are no workarounds. ### Special thanks Tulir Asokan, who spotted the issue originally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/matrix-org/dendrite | < 0.9.8 | 0.9.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matrix | Dendrite | before 0.9.8 |