vulnerability

FreeBSD: VID-93eb0e48-14ba-11ec-875e-901b0e9408dc (CVE-2021-40823): Matrix clients -- several vulnerabilities

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

Published

Sep 13, 2021

Added

Nov 4, 2022

Modified

Jun 15, 2026

Description

A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

Solutions

freebsd-upgrade-package-cinnyfreebsd-upgrade-package-element-webfreebsd-upgrade-package-nheko

References

CVE-2021-40823
https://attackerkb.com/topics/CVE-2021-40823
CWE-290
EUVD-EUVD-2021-1944
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1944

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report