GHSA-37hr-348p-rmf4

    Dashboard / Vulnerabilities / GHSA-37hr-348p-rmf4

    GHSA-37hr-348p-rmf4

    Published: 23 May 2022Last Modified: 8 Nov 2023

    Summary: Improper handling of multiline messages in node-irc affects matrix-appservice-irc

    Details: matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.

    References: https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4, https://github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6, https://nvd.nist.gov/vuln/detail/CVE-2022-29166, https://github.com/matrix-org/matrix-appservice-irc, https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity

    Affected packages

    Package

    Name: matrix-appservice-irc

    Purl: pkg:npm/matrix-appservice-irc

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.33.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-37hr-348p-rmf4 | CVE-DB