CVE-2022-39250 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-39250 Interim 1 21 2025-05-17T01:19:55Z current 2022-09-30T23:36:31Z 2025-05-17T01:19:55Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-39250 Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users' identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2022-October/012724.html E-Mail link for SUSE-SU-2022:3800-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 7 SUSE Liberty Linux 8 SUSE Liberty Linux 9 SUSE Linux Enterprise Workstation Extension 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Module for Package Hub 15 SP3 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP6 SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP7 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed MozillaThunderbird-102.3.1-1.1 MozillaThunderbird-102.4.0-150200.8.85.1 MozillaThunderbird-translations-common-102.3.1-1.1 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 MozillaThunderbird-translations-other-102.3.1-1.1 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 element-desktop-1.11.8-1.1 element-web-1.11.8-1.1 thunderbird-102.4.0-1.el7_9 thunderbird-102.4.0-1.el8_6 thunderbird-102.4.0-1.el9_0 thunderbird-102.4.0-1.el7_9 as a component of SUSE Liberty Linux 7 thunderbird-102.4.0-1.el8_6 as a component of SUSE Liberty Linux 8 thunderbird-102.4.0-1.el9_0 as a component of SUSE Liberty Linux 9 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.3 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.3 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.3 MozillaThunderbird-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.4 MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.4 MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 as a component of openSUSE Leap 15.4 MozillaThunderbird-102.3.1-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-common-102.3.1-1.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-other-102.3.1-1.1 as a component of openSUSE Tumbleweed element-desktop-1.11.8-1.1 as a component of openSUSE Tumbleweed element-web-1.11.8-1.1 as a component of openSUSE Tumbleweed Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users' identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround. CVE-2022-39250 SUSE Liberty Linux 7:thunderbird-102.4.0-1.el7_9 SUSE Liberty Linux 8:thunderbird-102.4.0-1.el8_6 SUSE Liberty Linux 9:thunderbird-102.4.0-1.el9_0 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP3:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP3:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP3:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP3:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP4:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP4:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP4:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 openSUSE Leap 15.3:MozillaThunderbird-102.4.0-150200.8.85.1 openSUSE Leap 15.3:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 openSUSE Leap 15.3:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 openSUSE Leap 15.4:MozillaThunderbird-102.4.0-150200.8.85.1 openSUSE Leap 15.4:MozillaThunderbird-translations-common-102.4.0-150200.8.85.1 openSUSE Leap 15.4:MozillaThunderbird-translations-other-102.4.0-150200.8.85.1 openSUSE Tumbleweed:MozillaThunderbird-102.3.1-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-102.3.1-1.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-102.3.1-1.1 openSUSE Tumbleweed:element-desktop-1.11.8-1.1 openSUSE Tumbleweed:element-web-1.11.8-1.1 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N