What is GHSA-jjmc-4p83-pp26?

GHSA-jjmc-4p83-pp26 is a security advisory published by GitHub Security Advisories with Medium severity. Logic error in Matrix SDK for Android

Which CVE IDs does GHSA-jjmc-4p83-pp26 cover?

GHSA-jjmc-4p83-pp26 covers the following CVE IDs: CVE-2021-40824. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jjmc-4p83-pp26?

GHSA-jjmc-4p83-pp26 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-jjmc-4p83-pp26?

GHSA-jjmc-4p83-pp26 affects 1 product, including: maven/org.matrix.android:matrix-android-sdk2:\u003c 1.2.2.

GHSA-jjmc-4p83-pp26MediumCVSS 5.9

Logic error in Matrix SDK for Android

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

August 18, 2023

🔗 CVE IDs covered (1)

CVE-2021-40824 →

📋 Description

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 leads to a situation where identity verification is inadequate and thus a key-requesting device can be impersonated.

🎯 Affected products1

maven/org.matrix.android:matrix-android-sdk2:< 1.2.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-40824
https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.2.2
https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing
https://github.com/advisories/GHSA-jjmc-4p83-pp26