Every CVE Search/ Get API key

CVE-2022-39251

Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

8.6 HighFix available

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.18%Up 0.2 points since Sep 29, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.6

Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
CVE-2022-39251
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-322, CWE-287
Updated
2026-11-02
EUVDEUVD-2022-6927 8.6

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
EUVD-2022-6927
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r48r-j8fx-mq2c 8.6

matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Impact

An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield.

Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver.

These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

Patches

matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages.

Out of caution, several other checks have been audited or added:

  • Cleartext m.room_key, m.forwarded_room_key and m.secret.send to_device messages are discarded.
  • Secrets received from untrusted devices are discarded.
  • Key backups are only usable if they have a valid signature from a trusted device (no more local trust, or trust-on-decrypt).
  • The origin of a to-device message should only be determined by observing the Olm session which managed to decrypt the message, and not by using claimed sender_key, user_id, or any other fields controllable by the homeserver.

Workarounds

As this attack requires coordination between a malicious home server and an attacker, if you trust your home server no particular workaround is needed. Notice that the backup spoofing attack is a particularly sophisticated targeted attack.

We are not aware of this attack being used in the wild, though specifying a false positive-free way of noticing malicious key backups key is challenging.

As an abundance of caution, to avoid malicious backup attacks, you should not verify your new logins using emoji/QR verifications methods until patched. Prefer verifying with your security passphrase instead.

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at [email protected].

Record
GHSA-r48r-j8fx-mq2c
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
NVD 8.6

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
CVE-2022-39251
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
OSVALPINE-CVE-2022-39251 7.5

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
ALPINE-CVE-2022-39251
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 8.6

Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
CVE-2022-39251
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2022-39251 7.5

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
DEBIAN-CVE-2022-39251
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-r48r-j8fx-mq2c 8.6

matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Impact

An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield.

Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver.

These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

Patches

matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages.

Out of caution, several other checks have been audited or added:

  • Cleartext m.room_key, m.forwarded_room_key and m.secret.send to_device messages are discarded.
  • Secrets received from untrusted devices are discarded.
  • Key backups are only usable if they have a valid signature from a trusted device (no more local trust, or trust-on-decrypt).
  • The origin of a to-device message should only be determined by observing the Olm session which managed to decrypt the message, and not by using claimed sender_key, user_id, or any other fields controllable by the homeserver.

Workarounds

As this attack requires coordination between a malicious home server and an attacker, if you trust your home server no particular workaround is needed. Notice that the backup spoofing attack is a particularly sophisticated targeted attack.

We are not aware of this attack being used in the wild, though specifying a false positive-free way of noticing malicious key backups key is challenging.

As an abundance of caution, to avoid malicious backup attacks, you should not verify your new logins using emoji/QR verifications methods until patched. Prefer verifying with your security passphrase instead.

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at [email protected].

Record
GHSA-r48r-j8fx-mq2c
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-322
Updated
2026-11-02
OSVRHSA-2022:7178 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7178
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7181 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7181
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7182 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7182
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7183 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7183
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7184 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7184
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7190 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2022:7190
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:7190 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

  • Mozilla: Denial of Service via window.print (CVE-2022-42929)

  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:7190
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-39251 8.6

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

Record
UBUNTU-CVE-2022-39251
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2022:7178 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)
  • Mozilla: Denial of Service via window.print (CVE-2022-42929)
  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7178
Updated
2026-11-02
OSVALSA-2022:7190 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.4.0.

Security Fix(es):

  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators (CVE-2022-39249)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)
  • Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)
  • Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)
  • Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)
  • Mozilla: Denial of Service via window.print (CVE-2022-42929)
  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7190
Updated
2026-11-02
OSVMGASA-2022-0355 No score

Updated thunderbird packages fix security vulnerability

Improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly(CVE-2022-39236) Too permissive key forwarding strategy allowing impersonation (CVE-2022-39249) Trusting/verifying the user identity under the control of the homeserver instead of the intended one. (CVE-2022-39250) Fake to-device messages appearing to originate from another user. (CVE-2022-39251)

Record
MGASA-2022-0355
Updated
2026-11-02
OSVopenSUSE-SU-2024:12374-1 No score

element-desktop-1.11.8-1.1 on GA media

These are all security issues fixed in the element-desktop-1.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12374-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12375-1 No score

element-web-1.11.8-1.1 on GA media

These are all security issues fixed in the element-web-1.11.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12375-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12379-1 No score

MozillaThunderbird-102.3.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-102.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12379-1
Updated
2026-11-02
OSVSUSE-SU-2022:3800-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 102.4.0 (bsc#1204421)
    • changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by using the profile import tool in Thunderbird 102
    • fixed: POP message download into a large folder (~13000 messages) caused Thunderbird to temporarily freeze
    • fixed: Forwarding messages with special characters in Subject failed on Windows
    • fixed: Links for FileLink attachments were not added when attachment filename contained Unicode characters
    • fixed: Address Book display pane continued to show contacts after deletion
    • fixed: Printing address book did not include all contact details
    • fixed: CardDAV contacts without a Name property did not save to Google Contacts
    • fixed: 'Publish Calendar' did not work
    • fixed: Calendar database storage improvements
    • fixed: Incorrectly handled error responses from CalDAV servers sometimes caused events to disappear from calendar
    • fixed: Various visual and UX improvements
  • Mozilla Thunderbird 102.3.3
    • new: Option added to show containing address book for a contact when using All Address Books in vertical mode (bmo#1778871)
    • changed: Thunderbird will try to use POP NTLM authentication even if not advertised by server (bmo#1793349)
    • changed: Task List and Today Pane sidebars will no longer load when not visible (bmo#1788549)
    • fixed: Sending a message while a recipient pill was being modified did not save changes (bmo#1779785)
    • fixed: Nickname column was not available in horizontal view of Address Book (bmo#1778000)
    • fixed: Multiline organization values were displayed across two columns in horizontal view of Address Book (bmo#1777780)
    • fixed: Contact vCard fields with multiple values such as Categories were truncated when saved (bmo#1792399)
    • fixed: ICS calendar files with a FREEBUSY property could not be imported (bmo#1783441)
    • fixed: Thunderbird would hang if calendar event exceeded the year 2035 (bmo#1789999)
  • Mozilla Thunderbird 102.3.2
    • changed: Thunderbird will try to use POP CRAM-MD5 authentication even if not advertised by server (bmo#1789975)
    • fixed: Checking messages on POP3 accounts caused POP folder to lock if mail server was slow or non-responsive (bmo#1792451)
    • fixed: Newsgroups named with consecutive dots would not appear when refreshing list of newsgroups (bmo#1787789)
    • fixed: Sending news articles containing lines starting with dot were sometimes clipped (bmo#1787955)
    • fixed: CardDAV server sync silently failed if sync token expired (bmo#1791183)
    • fixed: Contacts from LDAP on macOS address books were not displayed (bmo#1791347)
    • fixed: Chat account input now accepts URIs for supported chat protocols (bmo#1776706)
    • fixed: Chat ScreenName field was not migrated to new address book (bmo#1789990)
    • fixed: Creating a New Event from the Today Pane used the currently selected day from the main calendar instead of from the Today Pane (bmo#1791203)
    • fixed: New Event button in Today Pane was incorrectly disabled sometimes (bmo#1792058)
    • fixed: Event reminder windows did not close after being dismissed or snoozed (bmo#1791228)
    • fixed: Improved performance of recurring event date calculation (bmo#1787677)
    • fixed: Quarterly calendar events on the last day of the month repeated one month early (bmo#1789362)
    • fixed: Thunderbird would hang if calendar event exceeded the year 2035 (bmo#1789999)
    • fixed: Whitespace in calendar events was incorrectly handled when upgrading from Thunderbird 91 to 102 (bmo#1790339)
    • fixed: Various visual and UX improvements (bmo#1755623,bmo#17 83903,bmo#1785851,bmo#1786434,bmo#1787286,bmo#1788151,bmo#178 9728,bmo#1790499)
  • Mozilla Thunderbird 102.3.1
    • changed: Compose window encryption options now only appear for encryption…
Record
SUSE-SU-2022:3800-1
Updated
2026-11-02
OSVUSN-5724-1 No score

thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy (CSP) or other security restrictions, or execute arbitrary code. These issues only affect Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3266, CVE-2022-40956, CVE-2022-40957, CVE-2022-40958, CVE-2022-40959, CVE-2022-40960, CVE-2022-40962)

Multiple security issues were discovered in the Matrix SDK bundled with Thunderbird. An attacker could potentially exploit these in order to impersonate another user. These issues only affect Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39236, CVE-2022-39249, CVE-2022-39250, CVE-2022-39251)

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2022-42927, CVE-2022-42928, CVE-2022-42929, CVE-2022-42932)

Record
USN-5724-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
matrix-js-sdk
npm
 before 19.7.0
19.7.0
element-web
Alpine:v3.18
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.19
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.20
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.21
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.22
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.23
 before 1.11.7-r0
1.11.7-r0
element-web
Alpine:v3.24
 before 1.11.7-r0
1.11.7-r0
riot-web
Alpine:v3.16
 before 1.11.7-r0
1.11.7-r0
riot-web
Alpine:v3.17
 before 1.11.7-r0
1.11.7-r0
Show 46 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
AlmaLinux:9
From an advisory covering 8 CVEs
 before 102.4.0-1.el9_0.alma
102.4.0-1.el9_0.alma
thunderbird
AlmaLinux:8
From an advisory covering 8 CVEs
 before 102.4.0-1.el8_6.alma
102.4.0-1.el8_6.alma
node-matrix-js-sdk
Debian:11
 All versions, plus listed versions
9.11.0+~cs9.9.16-19.11.0+~cs9.9.16-29.3.0+~cs9.9.16-29.7.0~~rc1+~cs9.9.16-19.7.0~~rc1+~cs9.9.16-2
 None known
thunderbird
Mageia:8
From an advisory covering 4 CVEs
 before 102.3.1-1.mga8
102.3.1-1.mga8
thunderbird-l10n
Mageia:8
From an advisory covering 4 CVEs
 before 102.3.1-1.mga8
102.3.1-1.mga8
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el9_0
0:102.4.0-1.el9_0
thunderbird
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_4
0:102.4.0-1.el8_4
thunderbird
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_2
0:102.4.0-1.el8_2
thunderbird
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird-debuginfo
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird-debugsource
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_1
0:102.4.0-1.el8_1
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el7_9
0:102.4.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6
0:102.4.0-1.el8_6
thunderbird
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:102.4.0-1.el8_6.0.1
0:102.4.0-1.el8_6.0.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
MozillaThunderbird
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 102.4.0-150200.8.85.1
102.4.0-150200.8.85.1
thunderbird
Ubuntu:18.04:LTS
 before 1:102.4.2+build2-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 26 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.21:91.5.0+build1-0ubuntu0.18.04.11:91.7.0+build2-0ubuntu0.18.04.11:91.8.1+build1-0ubuntu0.18.04.11:91.9.1+build1-0ubuntu0.18.04.11:91.11.0+build2-0ubuntu0.18.04.11:102.2.2+build1-0ubuntu0.18.04.1
1:102.4.2+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:20.04:LTS
 before 1:102.4.2+build2-0ubuntu0.20.04.1, plus listed versions
1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1
Show 21 moreShow less
1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.11:91.11.0+build2-0ubuntu0.20.04.11:102.2.2+build1-0ubuntu0.20.04.1
1:102.4.2+build2-0ubuntu0.20.04.1
node-matrix-js-sdk
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
node-matrix-js-sdk
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.3.0+~cs9.9.16-29.11.0+~cs9.9.16-1
 None known
thunderbird
Ubuntu:22.04:LTS
 before 1:102.4.2+build2-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 10 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.1
1:102.4.2+build2-0ubuntu0.22.04.1
node-matrix-js-sdk
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.11.0+~cs9.9.16-2
 None known
thunderbird
Ubuntu:18.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 26 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.21:91.5.0+build1-0ubuntu0.18.04.11:91.7.0+build2-0ubuntu0.18.04.11:91.8.1+build1-0ubuntu0.18.04.11:91.9.1+build1-0ubuntu0.18.04.11:91.11.0+build2-0ubuntu0.18.04.11:102.2.2+build1-0ubuntu0.18.04.1
1:102.4.2+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:20.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.20.04.1, plus listed versions
1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1
Show 21 moreShow less
1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.11:91.11.0+build2-0ubuntu0.20.04.11:102.2.2+build1-0ubuntu0.20.04.1
1:102.4.2+build2-0ubuntu0.20.04.1
thunderbird
Ubuntu:22.04:LTS
From an advisory covering 15 CVEs
 before 1:102.4.2+build2-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 10 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.1
1:102.4.2+build2-0ubuntu0.22.04.1
element-desktop
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.8-1.1
1.11.8-1.1
element-web
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.8-1.1
1.11.8-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 102.3.1-1.1
102.3.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39251 is a high vulnerability (CVSS 8.6) in Matrix Javascript Sdk, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in matrix-js-sdk 19.7.0.

References

Show 98 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open