Homepage
About Snyk

org.matrix.android:matrix-android-sdk2@1.3.13 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.matrix.android:matrix-android-sdk2 package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Key Exchange without Entity Authentication

org.matrix.android:matrix-android-sdk2 is a Matrix SDK for Android, extracted from the Element Android application.

Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.

How to fix Key Exchange without Entity Authentication?

Upgrade org.matrix.android:matrix-android-sdk2 to version 1.5.1 or higher.

[,1.5.1)
  • H
Authentication Bypass

org.matrix.android:matrix-android-sdk2 is a Matrix SDK for Android, extracted from the Element Android application.

Affected versions of this package are vulnerable to Authentication Bypass due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device.

How to fix Authentication Bypass?

Upgrade org.matrix.android:matrix-android-sdk2 to version 1.5.1 or higher.

[,1.5.1)
Go back to all versions of this package