CVE-2021-44538 - log back

CVE-2021-44538 edited at 14 Dec 2021 16:16:36
- Unknown
+ Medium
- Unknown
+ Remote
- Unknown
+ Arbitrary code execution
+ The olm_session_describe function in Matrix libolm before version 3.2.8 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits.
CVE-2021-44538 created at 14 Dec 2021 16:13:49