Every CVE Search/ Get API key

CVE-2022-39250

Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

8.6 HighFix available

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.19%Up 0.2 points since Sep 30, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.6

Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
CVE-2022-39250
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-322, CWE-287
Updated
2026-11-02
EUVDEUVD-2022-6713 8.6

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
EUVD-2022-6713
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5w8r-8pgj-5jmf 8.6

matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

Impact

An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one.

The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps.

Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable.

Patches

The matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key.

Workarounds

As this attack requires coordination between a malicious homeserver and an attacker -- if you trust your homeserver no particular workaround is needed.

As a potential way of detecting compromise, it’s possible to review your device list or the device list of other users for devices with IDs in the form of a base64 cross-signing key (5XaczGNlfz0bl8R1IX5qn+tBoue2tWJqLMh+SDUuvCk) instead of classical device ID (SEHACYDHMG).

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at [email protected]

Record
GHSA-5w8r-8pgj-5jmf
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
NVD 8.6

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
CVE-2022-39250
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
OSVALPINE-CVE-2022-39250 7.5

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
ALPINE-CVE-2022-39250
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 8.6

Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
CVE-2022-39250
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2022-39250 7.5

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
DEBIAN-CVE-2022-39250
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-5w8r-8pgj-5jmf 8.6

matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

Impact

An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one.

The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps.

Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable.

Patches

The matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key.

Workarounds

As this attack requires coordination between a malicious homeserver and an attacker -- if you trust your homeserver no particular workaround is needed.

As a potential way of detecting compromise, it’s possible to review your device list or the device list of other users for devices with IDs in the form of a base64 cross-signing key (5XaczGNlfz0bl8R1IX5qn+tBoue2tWJqLMh+SDUuvCk) instead of classical device ID (SEHACYDHMG).

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at [email protected]

Record
GHSA-5w8r-8pgj-5jmf
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
OSVRHSA-2022:7178 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7178
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7181 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7181
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7182 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7182
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7183 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7183
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7184 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7184
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7190 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7190
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:7190 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

  • Mozilla: Denial of Service via window.print (CVE-2022-42929)

  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:7190
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-39250 8.6

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Record
UBUNTU-CVE-2022-39250
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2022:7178 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)
  • Mozilla: Denial of Service via window.print (CVE-2022-42929)
  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7178
Updated
2026-11-02
OSVALSA-2022:7190 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)
  • Mozilla: Denial of Service via window.print (CVE-2022-42929)
  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7190
Updated
2026-11-02
OSVMGASA-2022-0355 No score

Updated thunderbird packages fix security vulnerability

Improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly(CVE-2022-39236) Too permissive key forwarding strategy allowing impersonation (CVE-2022-39249) Trusting/verifying the user identity under the control of the homeserver instead of the intended one. (CVE-2022-39250) Fake to-device messages appearing to originate from another user. (CVE-2022-39251)

Record
MGASA-2022-0355
Updated
2026-11-02
OSVopenSUSE-SU-2024:12374-1 No score

element-desktop-1.11.8-1.1 on GA media

These are all security issues fixed in the element-desktop-1.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12374-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12375-1 No score

element-web-1.11.8-1.1 on GA media

These are all security issues fixed in the element-web-1.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12375-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12379-1 No score

MozillaThunderbird-102.3.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-102.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12379-1
Updated
2026-11-02
OSVSUSE-SU-2022:3800-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 102.4.0 (bsc#1204421)
    • changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by using the profile import tool in Thunderbird 102
    • fixed: POP message download into a large folder (~13000 messages) caused Thunderbird to temporarily freeze
    • fixed: Forwarding messages with special characters in Subject failed on Windows
    • fixed: Links for FileLink attachments were not added when attachment filename contained Unicode characters
    • fixed: Address Book display pane continued to show contacts after deletion
    • fixed: Printing address book did not include all contact details
    • fixed: CardDAV contacts without a Name property did not save to Google Contacts
    • fixed: 'Publish Calendar' did not work
    • fixed: Calendar database storage improvements
    • fixed: Incorrectly handled error responses from CalDAV servers sometimes caused events to disappear from calendar
    • fixed: Various visual and UX improvements
  • Mozilla Thunderbird 102.3.3
    • new: Option added to show containing address book for a contact when using All Address Books in vertical mode (bmo#1778871)
    • changed: Thunderbird will try to use POP NTLM authentication even if not advertised by server (bmo#1793349)
    • changed: Task List and Today Pane sidebars will no longer load when not visible (bmo#1788549)
    • fixed: Sending a message while a recipient pill was being modified did not save changes (bmo#1779785)
    • fixed: Nickname column was not available in horizontal view of Address Book (bmo#1778000)
    • fixed: Multiline organization values were displayed across two columns in horizontal view of Address Book (bmo#1777780)
    • fixed: Contact vCard fields with multiple values such as Categories were truncated when saved (bmo#1792399)
    • fixed: ICS calendar files with a FREEBUSY property could not be imported (bmo#1783441)
    • fixed: Thunderbird would hang if calendar event exceeded the year 2035 (bmo#1789999)
  • Mozilla Thunderbird 102.3.2
    • changed: Thunderbird will try to use POP CRAM-MD5 authentication even if not advertised by server (bmo#1789975)
    • fixed: Checking messages on POP3 accounts caused POP folder to lock if mail server was slow or non-responsive (bmo#1792451)
    • fixed: Newsgroups named with consecutive dots would not appear when refreshing list of newsgroups (bmo#1787789)
    • fixed: Sending news articles containing lines starting with dot were sometimes clipped (bmo#1787955)
    • fixed: CardDAV server sync silently failed if sync token expired (bmo#1791183)
    • fixed: Contacts from LDAP on macOS address books were not displayed (bmo#1791347)
    • fixed: Chat account input now accepts URIs for supported chat protocols (bmo#1776706)
    • fixed: Chat ScreenName field was not migrated to new address book (bmo#1789990)
    • fixed: Creating a New Event from the Today Pane used the currently selected day from the main calendar instead of from the Today Pane (bmo#1791203)
    • fixed: New Event button in Today Pane was incorrectly disabled sometimes (bmo#1792058)
    • fixed: Event reminder windows did not close after being dismissed or snoozed (bmo#1791228)
    • fixed: Improved performance of recurring event date calculation (bmo#1787677)
    • fixed: Quarterly calendar events on the last day of the month repeated one month early (bmo#1789362)
    • fixed: Thunderbird would hang if calendar event exceeded the year 2035 (bmo#1789999)
    • fixed: Whitespace in calendar events was incorrectly handled when upgrading from Thunderbird 91 to 102 (bmo#1790339)
    • fixed: Various visual and UX improvements (bmo#1755623,bmo#17 83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178 9728,bmo#1790499)
  • Mozilla Thunderbird 102.3.1
    • changed: Compose window encryption options now only appear for encryption…
Record
SUSE-SU-2022:3800-1
Updated
2026-11-02
OSVUSN-5724-1 No score

thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy (CSP) or other security restrictions, or execute arbitrary code. These issues only affect Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3266, CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40962)

Multiple security issues were discovered in the Matrix SDK bundled with Thunderbird. An attacker could potentially exploit these in order to impersonate another user. These issues only affect Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39236, CVE-2022-39249, CVE-2022-39250, CVE-2022-39251)

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2022-42927, CVE-2022-42928, CVE-2022-42929, CVE-2022-42932)

Record
USN-5724-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
matrix-js-sdk
npm
 before 19.7.0
19.7.0
element-web
Alpine:v3.18
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.19
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.20
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.21
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.22
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.23
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.24
 before 1.11.7-r0
1.11.7-r0
riot-web
Alpine:v3.16
 before 1.11.7-r0
1.11.7-r0
riot-web
Alpine:v3.17
 before 1.11.7-r0
1.11.7-r0
Show 46 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
AlmaLinux:9
From an advisory covering 8 CVEs
 before 102.4.0-1.el9_0.alma
102.4.0-1.el9_0.alma
thunderbird
AlmaLinux:8
From an advisory covering 8 CVEs
 before 102.4.0-1.el8_6.alma
102.4.0-1.el8_6.alma
node-matrix-js-sdk
Debian:11
 All versions, plus listed versions
9.11.0+~cs9.9.16-19.11.0+~cs9.9.16-29.3.0+~cs9.9.16-29.7.0~~rc1+~cs9.9.16-19.7.0~~rc1+~cs9.9.16-2
 None known
thunderbird
Mageia:8
From an advisory covering 4 CVEs
 before 102.3.1-1.mga8
102.3.1-1.mga8
thunderbird-l10n
Mageia:8
From an advisory covering 4 CVEs
 before 102.3.1-1.mga8
102.3.1-1.mga8
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird-debuginfo
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird-debugsource
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6.0.1
0:102.4.0-1.el8_6.0.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
thunderbird
Ubuntu:18.04:LTS
 before 1:102.4.2+build2-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 26 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.21:91.5.0+build1-0ubuntu0.18.04.11:91.7.0+build2-0ubuntu0.18.04.11:91.8.1+build1-0ubuntu0.18.04.11:91.9.1+build1-0ubuntu0.18.04.11:91.11.0+build2-0ubuntu0.18.04.11:102.2.2+build1-0ubuntu0.18.04.1
1:102.4.2+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:20.04:LTS
 before 1:102.4.2+build2-0ubuntu0.20.04.1, plus listed versions
1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1
Show 21 moreShow less
1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.11:91.11.0+build2-0ubuntu0.20.04.11:102.2.2+build1-0ubuntu0.20.04.1
1:102.4.2+build2-0ubuntu0.20.04.1
node-matrix-js-sdk
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
node-matrix-js-sdk
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.3.0+~cs9.9.16-29.11.0+~cs9.9.16-1
 None known
thunderbird
Ubuntu:22.04:LTS
 before 1:102.4.2+build2-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 10 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.1
1:102.4.2+build2-0ubuntu0.22.04.1
node-matrix-js-sdk
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.11.0+~cs9.9.16-2
 None known
thunderbird
Ubuntu:18.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 26 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.21:91.5.0+build1-0ubuntu0.18.04.11:91.7.0+build2-0ubuntu0.18.04.11:91.8.1+build1-0ubuntu0.18.04.11:91.9.1+build1-0ubuntu0.18.04.11:91.11.0+build2-0ubuntu0.18.04.11:102.2.2+build1-0ubuntu0.18.04.1
1:102.4.2+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:20.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.20.04.1, plus listed versions
1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1
Show 21 moreShow less
1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.11:91.11.0+build2-0ubuntu0.20.04.11:102.2.2+build1-0ubuntu0.20.04.1
1:102.4.2+build2-0ubuntu0.20.04.1
thunderbird
Ubuntu:22.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 10 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.1
1:102.4.2+build2-0ubuntu0.22.04.1
element-desktop
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.8-1.1
1.11.8-1.1
element-web
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.8-1.1
1.11.8-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 102.3.1-1.1
102.3.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39250 is a high vulnerability (CVSS 8.6) in Matrix Javascript Sdk, published September 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in matrix-js-sdk 19.7.0.

References

Show 98 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open