A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before     12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys     (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating     in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected     clients. (CVE-2021-40823)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before
    12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys
    (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating
    in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected
    clients. (CVE-2021-40823)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before
    12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys
    (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating
    in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected
    clients. (CVE-2021-40823)

  - A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-
    sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an
    encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally
    sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end
    encrypted messages sent by affected clients. (CVE-2021-40824)

Matrix developers report :

Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element (Web/Desktop/Android), FluffyChat, Nheko, Cinny, and SchildiChat.

Specifically, in certain circumstances it may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.

Exploiting this vulnerability to read encrypted messages requires gaining control over the recipient's account. This requires either compromising their credentials directly or compromising their homeserver.

ID	Name	Product	Family	Severity
224119	Linux Distros Unpatched Vulnerability : CVE-2021-40823	Nessus	Misc.	medium
408627	SCA: security update for matrix-js-sdk (GHSA-23cm-x6j7-6hq3)	Tenable Cloud Security	SCA Checks	medium
408627	SCA: security update for matrix-js-sdk (GHSA-23cm-x6j7-6hq3)	Tenable Self-Hosted Container Security	SCA Checks	medium
406933	Alpine: riot-web: security update to 1.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406933	Alpine: riot-web: security update to 1.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
404218	Alpine: element-web: security update to 1.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
404218	Alpine: element-web: security update to 1.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400124	Alpine: riot-web: security update to 1.8.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400124	Alpine: riot-web: security update to 1.8.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
153285	FreeBSD : Matrix clients -- several vulnerabilities (93eb0e48-14ba-11ec-875e-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-40823

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium