matrix-js-sdk vulnerable to invisible eavesdropping in group calls

Description

An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 24.1.0
• Patched version(s): 24.1.0

References

• GHSA-6g67-q39g-r79q
• CVE-2023-29529
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype pollution in matrix-js-sdk (part 2) - CVE-2023-28427
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059
• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336

Tags:

npm

matrix-js-sdk