GO-2022-0952

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2022-0952

Import Source

https://vuln.go.dev/ID/GO-2022-0952.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2022-0952

Aliases

Published

2022-08-22T18:08:50Z

Modified

2024-05-20T16:03:47Z

Summary

Incorrect event parsing in github.com/matrix-org/gomatrixserverlib

Details

Power level parsing does not parse the "events_default" key of the m.room.power_levels event, setting the event default power level to zero in all cases. This can cause events to be improperly accepted or rejected in rooms where the event_default power level has been changed.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2022-0952"
}

References

https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575

Affected packages

Go / github.com/matrix-org/gomatrixserverlib

Package

Name: github.com/matrix-org/gomatrixserverlib; View open source insights on deps.dev
Purl: pkg:golang/github.com/matrix-org/gomatrixserverlib

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20220815091947-723fd495dde8

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/matrix-org/gomatrixserverlib",
            "symbols": [
                "Allowed",
                "Event.PowerLevels",
                "EventsLoader.LoadAndVerify",
                "HeaderedReverseTopologicalOrdering",
                "NewPowerLevelContentFromAuthEvents",
                "NewPowerLevelContentFromEvent",
                "RequestBackfill",
                "ResolveConflicts",
                "ResolveStateConflicts",
                "ResolveStateConflictsV2",
                "RespSendJoin.Check",
                "RespState.Check",
                "RespState.Events",
                "ReverseTopologicalOrdering",
                "VerifyAuthRulesAtState",
                "VerifyEventAuthChain"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2022-0952.json"