GO-2022-0952

    Dashboard / Vulnerabilities / GO-2022-0952

    GO-2022-0952

    Published: 22 Aug 2022Last Modified: 20 May 2024

    Summary: Incorrect event parsing in github.com/matrix-org/gomatrixserverlib

    Details: Power level parsing does not parse the "events_default" key of the m.room.power_levels event, setting the event default power level to zero in all cases. This can cause events to be improperly accepted or rejected in rooms where the event_default power level has been changed.

    References: https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575

    Affected packages

    Package

    Name: github.com/matrix-org/gomatrixserverlib

    Purl: pkg:golang/github.com/matrix-org/gomatrixserverlib

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.0.0-20220815091947-723fd495dde8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2022-0952 | CVE-DB