Vulnerability · Published Sep 29, 2022 · Assigned by GitHub_M
CVE-2022-39254When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
High 8.6
In plain English
A high-severity improper authentication in matrix-nio from poljar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-matrix-nio | 0.20.0-1 | DEBIAN-CVE-2022-39254 |
| Debian:13 | python-matrix-nio | 0.20.0-1 | DEBIAN-CVE-2022-39254 |
| Debian:14 | python-matrix-nio | 0.20.0-1 | DEBIAN-CVE-2022-39254 |
| PyPI | matrix-nio | 0.20 | GHSA-w4pr-4vjg-hffh |
| PyPI | matrix-nio | 0.20 | PYSEC-2026-842 |
| Ubuntu:22.04:LTS | python-matrix-nio | no fix listed | UBUNTU-CVE-2022-39254 |
| Ubuntu:24.04:LTS | python-matrix-nio | no fix listed | UBUNTU-CVE-2022-39254 |
| Ubuntu:25.10 | python-matrix-nio | no fix listed | UBUNTU-CVE-2022-39254 |
| Ubuntu:26.04:LTS | python-matrix-nio | no fix listed | UBUNTU-CVE-2022-39254 |
| Ubuntu:26.10 | python-matrix-nio | no fix listed | UBUNTU-CVE-2022-39254 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| poljar | matrix-nio | < 0.20 |
Weakness: CWE-322, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N