CVE-2023-28427

NameCVE-2023-28427
Descriptionmatrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3400-1, DSA-5392-1
Debian Bugs1033621

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-matrix-js-sdk (PTS)buster0.9.2-1vulnerable
bullseye9.3.0+~cs9.9.16-2vulnerable
thunderbird (PTS)jessie, jessie (lts)1:68.9.0-1~deb8u2vulnerable
stretch (security), stretch (lts), stretch1:91.10.0-1~deb9u1vulnerable
buster (security), buster, buster (lts)1:115.12.0-1~deb10u1fixed
bullseye1:115.12.0-1~deb11u1fixed
bullseye (security)1:128.4.0esr-1~deb11u1fixed
bookworm1:115.12.0-1~deb12u1fixed
bookworm (security)1:115.16.0esr-1~deb12u1fixed
sid, trixie1:128.4.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-matrix-js-sdksource(unstable)(unfixed)1033621
thunderbirdsourcejessie(unfixed)end-of-life
thunderbirdsourcestretch(unfixed)end-of-life
thunderbirdsourcebuster1:102.10.0-1~deb10u1DLA-3400-1
thunderbirdsourcebullseye1:102.10.0-1~deb11u1DSA-5392-1
thunderbirdsource(unstable)1:102.9.1-1

Notes

[bullseye] - node-matrix-js-sdk <no-dsa> (Minor issue)
[buster] - node-matrix-js-sdk <no-dsa> (Minor issue)
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0/
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr
https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427

Search for package or bug name: Reporting problems