Login Request a demo
High severity · published Sep 29, 2022
CVE-2022-39252
When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-rust-sdk · matrix-org
< 0.6 · source: vendor, NVD
Affected product
MA
matrix-rust-sdk
matrix-org
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39252
Patch
https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbb
Patch
https://github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acd
Release Notes
https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.6.0
Third Party Advisory
https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-vp68-2wrm-69qm
More from matrix-rust-sdk
7.5
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
6.9
CVE-2026-45056
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
5.2
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
4.9
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
4.3
CVE-2024-52813
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity