CVE-2024-56515

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

Impact

If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file.

If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead.

MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit.

Patches

This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails.

Workarounds

Disabling the SVG, JPEGXL, and MP4 thumbnail types in the MMR config prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface.

Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg.

Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

References

A similar issue was discovered in Synapse: https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

Impact

If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file.

If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead.

MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit.

Patches

This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails.

Workarounds

Disabling the SVG, JPEGXL, and MP4 thumbnail types in the MMR config prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface.

Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg.

Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.

References

A similar issue was discovered in Synapse: https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g

Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo

These are all security issues fixed in the govulncheck-vulndb-0.0.20250117T214834-1.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
  • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
  • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
  • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
  • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
  • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
  • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
  • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
  • GO-2025-3422 CVE-2025-24354

• Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3372 CVE-2024-45339
  • GO-2025-3373 CVE-2024-45341
  • GO-2025-3383 CVE-2024-45340
  • GO-2025-3420 CVE-2024-45336
  • GO-2025-3421 CVE-2025-22865

• Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
  • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
  • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
  • GO-2025-3396 CVE-2024-52594
  • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
  • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
  • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
  • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
  • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
  • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

• Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
  • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
  • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
  • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
  • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

• Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
  • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
  • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
  • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79