GHSA-pfw4-xjgm-267c
Dendrite signature checks not applied to some retrieved missing events
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/matrix-org/dendrite | < 0.9.8 | 0.9.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Events retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.
Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified.
Homeservers that have federation disabled are not vulnerable.
### Patches
The problem has been fixed in Dendrite 0.9.8.
### Workarounds
There are no workarounds.
### Special thanks
Tulir Asokan, who spotted the issue originally.
References
External links from the advisory. They lead to third-party sites.