| Package | Affected versions | Patched versions |
|---|---|---|
| matrix irc bridge | < 1.0.1 | 1.0.1 |
| matrix-appservice-irc | < 1.0.1 | 1.0.1 |
It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target.
Please upgrade to 1.0.1.
You can set the matrixHandler.eventCacheSize config value to 0 to workaround this bug. However, this may impact performance.
Discovered and reported by Val Lorentz.
If you have any questions or comments about this advisory email us at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free