high8.6
CVE-2022-39254
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Impact
When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from. This allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack. ### For more information If you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | matrix-nio | < 0.20 | 0.20 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matrix-Nio Project | Matrix-Nio | before 0.20 |