CVE-2021-44538

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-44538
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44538.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-44538
Downstream
DEBIAN (1)
MGASA (2)
openSUSE (2)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2021-12-14T14:15:09Z
Modified
2026-10-22T02:48:11Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:cinny_project:cinny:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.6.0"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "cinny_project:cinny"
        },
        {
            "cpes": [
                "cpe:2.3:a:matrix:element:*:*:*:*:desktop:*:*:*",
                "cpe:2.3:a:matrix:element:*:*:*:*:web:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.9.7"
                        },
                        {
                            "fixed": "1.9.7"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "matrix:element"
        },
        {
            "cpes": [
                "cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "2.4.2"
                        },
                        {
                            "fixed": "15.2.1"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "matrix:javascript_sdk"
        },
        {
            "cpes": [
                "cpe:2.3:a:schildi:schildichat:*:*:*:*:desktop:*:*:*",
                "cpe:2.3:a:schildi:schildichat:*:*:*:*:web:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.9.7-sc1"
                        },
                        {
                            "fixed": "1.9.7-sc1"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "schildi:schildichat"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        },
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        },
                        {
                            "introduced": "11.0"
                        },
                        {
                            "last_affected": "11.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / gitlab.matrix.org/matrix-org/olm

Affected ranges

Type
GIT
Repo
https://gitlab.matrix.org/matrix-org/olm
Events
Introduced
6753595300767dd70150831dbbe6f92d64e75038
Fixed
797183f27f1c8cdb9d4551aaa317bd13ff02401b
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:matrix:olm:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.1.4"
                },
                {
                    "fixed": "3.2.8"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

3.*
3.1.4
3.1.5
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44538.json"