SynopsisThe remote Slackware Linux host is missing a security update to mozilla-thunderbird.
DescriptionThe version of mozilla-thunderbird installed on the remote host is prior to 102.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-273-01 advisory.
This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue. (CVE-2022-39236)
Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround. (CVE-2022-39249)
Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround. (CVE-2022-39250)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade the affected mozilla-thunderbird package.
File Name: Slackware_SSA_2022-273-01.nasl
Temporal Vector: E:U/RL:OF/RC:C
Temporal Vector: E:U/RL:O/RC:C
CPE: p-cpe:/a:slackware:slackware_linux:mozilla-thunderbird, cpe:/o:slackware:slackware_linux, cpe:/o:slackware:slackware_linux:15.0
Required KB Items: Host/local_checks_enabled, Host/Slackware/release, Host/Slackware/packages
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 9/28/2022