Description
The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they’re replying to when determining whether or not to include a truncated version of the original event in the IRC message.
Recommendation
Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.0.0
- Patched version(s): 2.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Matrix IRC Bridge truncated content of messages can be leaked - CVE-2024-32000
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
- tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
You might also like:
See something that needs correcting? Let us knowUpdated July 05, 2024