CVE-2022-39257

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-39257

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39257.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39257

Aliases

GHSA-qxr3-5jmq-xcf4

Published

2022-09-28T20:55:10Z

Modified

2026-07-22T02:08:02.407230Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions

Details

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strategy. The default policy for accepting key forwards has been made more strict in the matrix-ios-sdk version 0.23.19. matrix-ios-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a trusted flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with trusted = false are decorated appropriately (for example, by showing a warning for such messages). This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Database specific

{
    "cwe_ids": [
        "CWE-287",
        "CWE-322"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39257.json"
}

References

Affected packages

Git / github.com/matrix-org/matrix-ios-sdk

Affected ranges

Type

GIT

Repo

https://github.com/matrix-org/matrix-ios-sdk

Events

Introduced

Fixed

4442142c7111cf051d30d9015de7266a515bfc95

Fixed

5ca86c328a5faaab429c240551cb9ca8f0f6262c

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.23.19"
        }
    ],
    "cpe": "cpe:2.3:a:matrix:software_development_kit:*:*:*:*:*:iphone_os:*:*"
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.10

v0.10.11

v0.10.12

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.13.0

v0.13.1

v0.14.0

v0.15.0

v0.15.1

v0.15.2

v0.16.0

v0.16.1

v0.16.10

v0.16.11

v0.16.12

v0.16.13

v0.16.14

v0.16.15

v0.16.16

v0.16.17

v0.16.18

v0.16.19

v0.16.20

v0.16.4

v0.16.5

v0.16.6

v0.16.8

v0.16.9

v0.17.0

v0.17.1

v0.17.10

v0.17.11

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.17.6

v0.17.7

v0.17.8

v0.17.9

v0.18.0

v0.18.1

v0.18.10

v0.18.11

v0.18.12

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.18.8

v0.18.9

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.19.6

v0.19.7

v0.19.8

v0.2.2

v0.20.0

v0.20.1

v0.20.10

v0.20.11

v0.20.12

v0.20.13

v0.20.14

v0.20.15

v0.20.16

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.20.7

v0.20.8

v0.20.9

v0.21.0

v0.22.0

v0.22.1

v0.22.3

v0.22.4

v0.22.5

v0.22.6

v0.23.0

v0.23.1

v0.23.10

v0.23.11

v0.23.12

v0.23.13

v0.23.14

v0.23.15

v0.23.16

v0.23.17

v0.23.18

v0.23.2

v0.23.3

v0.23.4

v0.23.5

v0.23.6

v0.23.7

v0.23.8

v0.23.9

v0.3.0

v0.3.1

v0.3.1-r1

v0.3.2

v0.4.0

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.9.0

v0.9.1

v0.9.2

v0.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39257.json"

vanir_signatures_modified

"2026-07-22T02:08:02Z"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "72316361310660215691931429924248656841",
                "189705816796646848369622463688827033150",
                "2759542088427777407975446035108501989",
                "288326346438592934844332775474134550390"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-39257-07dcc288",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "target": {
            "file": "MatrixSDK/MatrixSDK.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "67533782217048731478845813822640661200",
                "179363983628606553136196328013506286956",
                "85506329710230119266986245676459050459",
                "269738058025597410218216131962536513506"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-39257-6b1b9555",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "target": {
            "file": "MatrixSDK/Crypto/KeyBackup/Data/MXKeyBackupVersionTrust.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "66351378363967913525731711829179713061",
                "278095958396896172607945763059320629255",
                "28855884788969288805322590027579852764",
                "170155866619890102279608280462406778425",
                "239071177152843437385360301179989644514"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-39257-9ce392d5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "target": {
            "file": "MatrixSDK/Crypto/MXCrypto_Private.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "272668942739153391175570236843389917764",
                "219901029857565321632056379059209492978",
                "302059645746209613230955050501983567248",
                "1672072197779040601041217422215633176",
                "335840380194476245255822729622053932410",
                "52316583242005744414175263803774447983",
                "175349735087660708318188361192521530113",
                "156142438452545808743477145715136721228"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-39257-a38faaa9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "target": {
            "file": "MatrixSDK/Crypto/Algorithms/MXDecrypting.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "95370822025649101032070280231532536163",
                "218538451127144728946738354929452478915",
                "8240106280630917728025718766878528805",
                "120226752188299944594824832498015762984"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2022-39257-a972c3de",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c",
        "target": {
            "file": "MatrixSDK/Crypto/MXOlmDevice.h"
        }
    }
]