CVE-2024-6300

概要

参考情報

• conduit.rs/changelog · Release Notes
• gitlab.com/famedly/conduit/-/releases/v0.8.0 · Release Notes

conduit のその他の脆弱性

• CVE-2024-6303高 8.8Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be …
• CVE-2024-6302中 5.5Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message fro…
• CVE-2024-6301高 7.5Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs
• CVE-2024-6299低 3.7Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forg…