Use the correct sender key when checking shared secret #2730
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
turt2live
approved these changes
Oct 4, 2022
Member
|
does this need including in the RC that went out today? |
Member
Author
If possible, this would probably be a good one to get in. |
turt2live
added
the
backport staging
RiotRobot
pushed a commit
that referenced
this pull request
Oct 4, 2022
(cherry picked from commit 890a840)
turt2live
pushed a commit
that referenced
this pull request
Oct 4, 2022
Contributor
|
Can / should this receive test coverage? |
odelcroi
added a commit
to tchapgouv/tchap-web-v4
that referenced
this pull request
Oct 6, 2022
* Use the correct sender key when checking shared secret ([\#2730](matrix-org/matrix-js-sdk#2730)). Fixes element-hq/element-web#23374.
su-ex
added a commit
to SchildiChat/matrix-js-sdk
that referenced
this pull request
Oct 29, 2022
* Changes the `uploadContent` API, kills off `request` and `browser-request` in favour of `fetch`, removed callback support on a lot of the methods, adds a lot of tests. ([\matrix-org#2719](matrix-org#2719)). Fixes matrix-org#2415 and matrix-org#801. * Remove deprecated `m.room.aliases` references ([\matrix-org#2759](matrix-org#2759)). Fixes element-hq/element-web#12680. * Remove node-specific crypto bits, use Node 16's WebCrypto ([\matrix-org#2762](matrix-org#2762)). Fixes matrix-org#2760. * Export types for MatrixEvent and Room emitted events, and make event handler map types stricter ([\matrix-org#2750](matrix-org#2750)). Contributed by @stas-demydiuk. * Use even more stable calls to `/room_keys` ([\matrix-org#2746](matrix-org#2746)). * Upgrade to Olm 3.2.13 which has been repackaged to support Node 18 ([\matrix-org#2744](matrix-org#2744)). * Fix `power_level_content_override` type ([\matrix-org#2741](matrix-org#2741)). * Add custom notification handling for MSC3401 call events ([\matrix-org#2720](matrix-org#2720)). * Add support for unread thread notifications ([\matrix-org#2726](matrix-org#2726)). * Load Thread List with server-side assistance (MSC3856) ([\matrix-org#2602](matrix-org#2602)). * Use stable calls to `/room_keys` ([\matrix-org#2729](matrix-org#2729)). Fixes element-hq/element-web#22839. * Fix POST data not being passed for registerWithIdentityServer ([\matrix-org#2769](matrix-org#2769)). Fixes matrix-org/element-web-rageshakes#16206. * Fix IdentityPrefix.V2 containing spurious `/api` ([\matrix-org#2761](matrix-org#2761)). Fixes element-hq/element-web#23505. * Always send back an httpStatus property if one is known ([\matrix-org#2753](matrix-org#2753)). * Check for AbortError, not any generic connection error, to avoid tightlooping ([\matrix-org#2752](matrix-org#2752)). * Correct the dir parameter of MSC3715 ([\matrix-org#2745](matrix-org#2745)). Contributed by @dhenneke. * Fix sync init when thread unread notif is not supported ([\matrix-org#2739](matrix-org#2739)). Fixes element-hq/element-web#23435. * Use the correct sender key when checking shared secret ([\matrix-org#2730](matrix-org#2730)). Fixes element-hq/element-web#23374.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes element-hq/element-web#23374
Bug was introduced in the recent security release.
The incorrect code is checking the
sender_keyin the encrypted content, which is normally not set. It should have been checking thesender_keyin the cleartext content, orevent.getSenderKey().Here's what your changelog entry will look like:
🐛 Bug Fixes