There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-
    sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an
    encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally
    sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end
    encrypted messages sent by affected clients. (CVE-2021-40824)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before
    12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys
    (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating
    in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected
    clients. (CVE-2021-40823)

  - A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-
    sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an
    encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally
    sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end
    encrypted messages sent by affected clients. (CVE-2021-40824)

マトリクス開発者レポート：

本日、Element（Web/Desktop/Android）、FluffyChat、Nheko、Cinny、SchildiChatを含む複数のMatrixクライアントおよびライブラリに影響する重大なセキュリティ問題を開示します。

具体的には、特定の状況で、脆弱なクライアントを騙して、そのクライアントがユーザーアカウントに以前送信したメッセージの暗号化キーを、攻撃者が後で侵害するように漏洩させる可能性があります。

この脆弱性を悪用して暗号化されたメッセージを読み取るためには、受信者のアカウントを制御する必要があります。これには、認証情報を直接侵害するか、ホームサーバーを侵害する必要があります。

Matrix developers report :

Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element (Web/Desktop/Android), FluffyChat, Nheko, Cinny, and SchildiChat.

Specifically, in certain circumstances it may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.

Exploiting this vulnerability to read encrypted messages requires gaining control over the recipient's account. This requires either compromising their credentials directly or compromising their homeserver.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
433513	SCA: security update for org.matrix.android:matrix-android-sdk2 (GHSA-jjmc-4p83-pp26)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/2	medium
404218	Alpine: element-web: security update to 1.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
406933	Alpine: riot-web: security update to 1.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
406933	Alpine: riot-web: security update to 1.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
433513	SCA: security update for org.matrix.android:matrix-android-sdk2 (GHSA-jjmc-4p83-pp26)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/2	medium
404218	Alpine: element-web: security update to 1.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
400124	Alpine: riot-web: security update to 1.8.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/8/16	2026/7/2	medium
400124	Alpine: riot-web: security update to 1.8.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/8/16	2026/7/2	medium
153285	FreeBSD：Matrixクライアント -- いくつかの脆弱性（93eb0e48-14ba-11ec-875e-901b0e9408dc）	Nessus	FreeBSD Local Security Checks	2021/9/14	2021/9/28	medium
153285	FreeBSD : Matrix clients -- several vulnerabilities (93eb0e48-14ba-11ec-875e-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2021/9/14	2021/9/28	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium