CVE-2022-39255

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-39255

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39255.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39255

Aliases

GHSA-hw6g-j8v6-9hcm

Published

2022-09-28T20:35:10Z

Modified

2026-07-22T02:08:01.134068Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion

Details

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-ios-sdk version 0.23.19 has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. To avoid malicious backup attacks, one should not verify one's new logins using emoji/QR verifications methods until patched.

Database specific

{
    "cwe_ids": [
        "CWE-287",
        "CWE-322"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39255.json"
}

References

Affected packages

Git / github.com/matrix-org/matrix-ios-sdk

Affected ranges

Type

GIT

Repo

https://github.com/matrix-org/matrix-ios-sdk

Events

Introduced

Fixed

4442142c7111cf051d30d9015de7266a515bfc95

Fixed

5ca86c328a5faaab429c240551cb9ca8f0f6262c

Database specific

{
    "cpe": "cpe:2.3:a:matrix:software_development_kit:*:*:*:*:*:iphone_os:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.23.19"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.10

v0.10.11

v0.10.12

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.13.0

v0.13.1

v0.14.0

v0.15.0

v0.15.1

v0.15.2

v0.16.0

v0.16.1

v0.16.10

v0.16.11

v0.16.12

v0.16.13

v0.16.14

v0.16.15

v0.16.16

v0.16.17

v0.16.18

v0.16.19

v0.16.20

v0.16.4

v0.16.5

v0.16.6

v0.16.8

v0.16.9

v0.17.0

v0.17.1

v0.17.10

v0.17.11

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.17.6

v0.17.7

v0.17.8

v0.17.9

v0.18.0

v0.18.1

v0.18.10

v0.18.11

v0.18.12

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.18.8

v0.18.9

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.19.6

v0.19.7

v0.19.8

v0.2.2

v0.20.0

v0.20.1

v0.20.10

v0.20.11

v0.20.12

v0.20.13

v0.20.14

v0.20.15

v0.20.16

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.20.7

v0.20.8

v0.20.9

v0.21.0

v0.22.0

v0.22.1

v0.22.3

v0.22.4

v0.22.5

v0.22.6

v0.23.0

v0.23.1

v0.23.10

v0.23.11

v0.23.12

v0.23.13

v0.23.14

v0.23.15

v0.23.16

v0.23.17

v0.23.18

v0.23.2

v0.23.3

v0.23.4

v0.23.5

v0.23.6

v0.23.7

v0.23.8

v0.23.9

v0.3.0

v0.3.1

v0.3.1-r1

v0.3.2

v0.4.0

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

Database specific

vanir_signatures_modified

"2026-07-22T02:08:01Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "72316361310660215691931429924248656841",
                "189705816796646848369622463688827033150",
                "2759542088427777407975446035108501989",
                "288326346438592934844332775474134550390"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "id": "CVE-2022-39255-07dcc288",
        "target": {
            "file": "MatrixSDK/MatrixSDK.h"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "67533782217048731478845813822640661200",
                "179363983628606553136196328013506286956",
                "85506329710230119266986245676459050459",
                "269738058025597410218216131962536513506"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "id": "CVE-2022-39255-6b1b9555",
        "target": {
            "file": "MatrixSDK/Crypto/KeyBackup/Data/MXKeyBackupVersionTrust.h"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "66351378363967913525731711829179713061",
                "278095958396896172607945763059320629255",
                "28855884788969288805322590027579852764",
                "170155866619890102279608280462406778425",
                "239071177152843437385360301179989644514"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "id": "CVE-2022-39255-9ce392d5",
        "target": {
            "file": "MatrixSDK/Crypto/MXCrypto_Private.h"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "272668942739153391175570236843389917764",
                "219901029857565321632056379059209492978",
                "302059645746209613230955050501983567248",
                "1672072197779040601041217422215633176",
                "335840380194476245255822729622053932410",
                "52316583242005744414175263803774447983",
                "175349735087660708318188361192521530113",
                "156142438452545808743477145715136721228"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "id": "CVE-2022-39255-a38faaa9",
        "target": {
            "file": "MatrixSDK/Crypto/Algorithms/MXDecrypting.h"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95370822025649101032070280231532536163",
                "218538451127144728946738354929452478915",
                "8240106280630917728025718766878528805",
                "120226752188299944594824832498015762984"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "id": "CVE-2022-39255-a972c3de",
        "target": {
            "file": "MatrixSDK/Crypto/MXOlmDevice.h"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39255.json"