CVE-2022-39250

highpriority · track · 30EPSS 0.012 · 68 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.19% (68th) EPSS
CVSS 7.5 · high
Is it mine?
76 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-26

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedthunderbird-0:102.4.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-0:102.4.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-0:102.4.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-0:102.4.0-1.el9_0.src as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-0:102.4.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debugsource-0:102.4.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debugsource-0:102.4.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debugsource-0:102.4.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-debugsource-0:102.4.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7178
  • Fixedthunderbird-0:102.4.0-1.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-0:102.4.0-1.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-0:102.4.0-1.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-0:102.4.0-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-0:102.4.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7181
  • Fixedthunderbird-0:102.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-0:102.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-0:102.4.0-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-0:102.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7182
  • Fixedthunderbird-0:102.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-0:102.4.0-1.el8_1.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-0:102.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7183
  • Fixedthunderbird-0:102.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7184
  • Fixedthunderbird-0:102.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-0:102.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-0:102.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-0:102.4.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-0:102.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debuginfo-0:102.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
  • Fixedthunderbird-debugsource-0:102.4.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of Thunderbird must be restarted for the update to take effect.

    https://access.redhat.com/errata/RHSA-2022:7190
02

cvss

Technical severity, 0–10. One row per scoring source.

8.6
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–8.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nsecondary · ENISA EU
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 4
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nsecondary · OSV
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · Red Hat Product Security US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-287USCWE-322USCWE-322USCWE-347US
05

affected products (76)

Products and version ranges known to be affected.

showing 20 of 76
06

advisories (8)

Vendor and ecosystem advisories describing this.

  • RHSA-2022:7178Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:7181Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:7182Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:7183Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:7184Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:7190Red Hat Security Advisory: thunderbird security update2022-10-25csaf · redhat_csafUS

    An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2022-1589Mozilla Thunderbird: Mehrere SchwachstellenDeutsch2022-09-29csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.

  • GHSA-5w8r-8pgj-5jmfmatrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification2022-09-30ghsa · osvUS

    ## Impact An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. ## Patches The matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. ## Workarounds As this attack requires coordination between a malicious homeserver and an attacker -- if you trust your homeserver no particular workaround is needed. As a potential way of detecting compromise, it’s possible to review your device list or the device list of other users for devices with IDs in the form of a base64 cross-signing key (`5XaczGNlfz0bl8R1IX5qn+tBoue2tWJqLMh+SDUuvCk`) instead of classical device ID (`SEHACYDHMG`). ## References Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients ## For more information If you have any questions or comments about this advisory, e-mail us at security@matrix.org

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundnvdosvredhat_csafNVDCVE.orgMITRE
published 2022-09-29modified 2026-06-17
10

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan