Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. Details The library does not check that the servername part of the sub parameter (containing the user's claimed MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a sub parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Workarounds Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.
Recommended action: Upgrade to 9.0.1 or 8.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If a bridge has room upgrade handling turned on in the configuration (the roomUpgradeOpts key when instantiating a new Bridge instance.), any m.room.tombstone event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room m.room.create event is not checked to verify if the predecessor field contains the previous room. This means that any mailcious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Patches Versions 2.6.1 and greater are patched. Workarounds Disabling the automatic room upgrade handling can be done by removing the roomUpgradeOpts key from the Bridge class options. References The issue is patched by https://github.com/matrix-org/matrix-appservice-bridge/pull/330 For more information] If you have any questions or comments about this advisory, email us at security@matrix.org.
Recommended action: Upgrade to 2.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.