CVE-2021-40823

Name	CVE-2021-40823
Description	A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	866502, 994213

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-matrix-js-sdk (PTS)	bullseye	9.3.0+~cs9.9.16-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
element-web	ITP					866502
node-matrix-js-sdk	source	(unstable)	(unfixed)			994213

Notes

[bullseye] - node-matrix-js-sdk <no-dsa> (Minor issue)
[buster] - node-matrix-js-sdk <no-dsa> (Minor issue)
https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing/
https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9 (v12.4.1)