CVE-2023-28427

Name	CVE-2023-28427
Description	matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-3400-1, DSA-5392-1
Debian Bugs	1033621

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-matrix-js-sdk (PTS)	buster	0.9.2-1	vulnerable
	bullseye	9.3.0+~cs9.9.16-2	vulnerable
	sid	9.11.0+~cs9.9.16-2	vulnerable
thunderbird (PTS)	buster	1:91.12.0-1~deb10u1	vulnerable
	buster (security)	1:102.11.0-1~deb10u1	fixed
	bullseye	1:102.10.0-1~deb11u1	fixed
	bullseye (security)	1:102.11.0-1~deb11u1	fixed
	bookworm, sid	1:102.11.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
node-matrix-js-sdk	source	(unstable)	(unfixed)		1033621
thunderbird	source	buster	1:102.10.0-1~deb10u1	DLA-3400-1
thunderbird	source	bullseye	1:102.10.0-1~deb11u1	DSA-5392-1
thunderbird	source	(unstable)	1:102.9.1-1

Notes

[bullseye] - node-matrix-js-sdk <no-dsa> (Minor issue)
[buster] - node-matrix-js-sdk <no-dsa> (Minor issue)
https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0/
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr
https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/#CVE-2023-28427