Dendrite signature checks not applied to some retrieved missing events

TRUNG BÌNH 5.3CVE-2022-39200 · GHSA-pfw4-xjgm-267c · GO-2022-0989 · Công bố 12/09/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-39200 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng github.com/matrix-org/dendrite, dendrite (matrix).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.36%, cao hơn 29.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.9.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/matrix-org/dendrite Go	`< 0.9.8`	`0.9.8`
dendrite matrix	`< 0.9.8`	`0.9.8`

Mô tả

Impact

Events retrieved from a remote homeserver using /get_missing_events did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.

Note that this does not apply to events retrieved through other endpoints (e.g. /event, /state) as they have been correctly verified.

Homeservers that have federation disabled are not vulnerable.

Patches

The problem has been fixed in Dendrite 0.9.8.

Workarounds

There are no workarounds.

Special thanks

Tulir Asokan, who spotted the issue originally.

Mô tả của NVD

Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.