Improper handling of multiline messages in node-irc affects matrix-appservice-irc

高 8.8CVE-2022-29166 · GHSA-37hr-348p-rmf4 · 05/05/2022 公開 · 17/06/2026 更新

要点

CVE-2022-29166 は matrix irc bridge (matrix), matrix-appservice-irc に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.0% より高い）。
対処：0.33.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
matrix irc bridge matrix	`< 0.33.2`	`0.33.2`
matrix-appservice-irc npm	`< 0.33.2`	`0.33.2`

概要

matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.

NVD の説明

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.