CVE-2021-44538

{"id": "CVE-2021-44538", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-12-14T14:15:09.410", "references": [{"url": "https://gitlab.matrix.org/matrix-org/olm/-/tags", "tags": ["Product", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.debian.org/security/2022/dsa-5034", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web."}, {"lang": "es", "value": "La funci\u00f3n olm_session_describe en Matrix libolm versiones anteriores a 3.2.7, es vulnerable a un desbordamiento de b\u00fafer. El objeto Olm session representa un canal criptogr\u00e1fico entre dos partes. Por lo tanto, su estado es parcialmente controlable por la parte remota del canal. Los atacantes pueden construir una secuencia de mensajes manipulada para manipular el estado de la sesi\u00f3n del receptor de tal manera que, para algunos tama\u00f1os de b\u00fafer, se produzca un desbordamiento de b\u00fafer en una llamada a olm_session_describe. Adem\u00e1s, los tama\u00f1os de b\u00fafer seguros no estaban documentados. El contenido del desbordamiento es parcialmente controlable por el atacante y se limita a espacios y d\u00edgitos ASCII. Los productos afectados conocidos son Element Web y SchildiChat Web"}], "lastModified": "2023-08-08T14:22:24.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrix:element:*:*:*:*:desktop:*:*:*", "vulnerable": true, "matchCriteriaId": "50D6A7E8-2090-4176-8BF2-CC4FBDB230A0", "versionEndExcluding": "1.9.7"}, {"criteria": "cpe:2.3:a:matrix:element:*:*:*:*:web:*:*:*", "vulnerable": true, "matchCriteriaId": "C55680D8-A282-4ACF-937A-FF568EF253A5", "versionEndExcluding": "1.9.7"}, {"criteria": "cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5FD9553-7738-44D7-B29A-687F292F9EFB", "versionEndExcluding": "15.2.1", "versionStartIncluding": "2.4.2"}, {"criteria": "cpe:2.3:a:matrix:olm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AA69814-4AB7-4F75-8E64-3BF1B70B157D", "versionEndExcluding": "3.2.8", "versionStartIncluding": "3.1.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schildi:schildichat:*:*:*:*:desktop:*:*:*", "vulnerable": true, "matchCriteriaId": "D0498DDF-E353-41F4-BF91-4A765BDCC955", "versionEndExcluding": "1.9.7-sc1"}, {"criteria": "cpe:2.3:a:schildi:schildichat:*:*:*:*:web:*:*:*", "vulnerable": true, "matchCriteriaId": "D8B93183-5BDA-4399-9E8B-EBD214B106FE", "versionEndExcluding": "1.9.7-sc1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cinny_project:cinny:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3620442-82E2-4655-BDD9-AD86FD571197", "versionEndExcluding": "1.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}