CVE-2021-44538 log

Severity Medium
Remote Yes
Type Arbitrary code execution
The olm_session_describe function in Matrix libolm before version 3.2.8 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits.
Group Package Affected Fixed Severity Status Ticket
AVG-2639 element-web 1.9.6-1 1.9.7-1 Medium Fixed
AVG-2638 libolm 3.2.7-2 3.2.8-1 Medium Fixed