CVE-2024-42369

{"id": "CVE-2024-42369", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "published": "2024-08-20T15:15:21.540", "references": [{"url": "https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-674"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1."}, {"lang": "es", "value": "Matrix-js-sdk es un SDK cliente-servidor del protocolo de mensajer\u00eda Matrix para JavaScript. Un servidor dom\u00e9stico malicioso puede crear una sala o una estructura de sala tal que los predecesores formen un ciclo. La funci\u00f3n getRoomUpgradeHistory de Matrix-js-sdk se repetir\u00e1 infinitamente en este caso, lo que provocar\u00e1 que el c\u00f3digo se cuelgue. Este m\u00e9todo es p\u00fablico pero tambi\u00e9n lo llama el m\u00e9todo 'leaveRoomChain()', por lo que salir de una habitaci\u00f3n tambi\u00e9n activar\u00e1 el error. Esto fue parcheado en Matrix-js-sdk 34.3.1."}], "lastModified": "2024-08-21T16:01:03.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C489179C-DCFC-4A63-B66D-7AD76CCD6663", "versionEndExcluding": "34.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}