From nobody Tue Nov 12 22:22:46 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Xp1BZ5fLdz5cj7k; Tue, 12 Nov 2024 22:22:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Xp1BZ3NrDz4Swy; Tue, 12 Nov 2024 22:22:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731450166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q0//vpoSQN1qoJwycjaQ5Gqo3WRlegmOW/Pq824DYmw=; b=a/ZUF17fmYFC8llLNR8OqHN1QnyU8ki73heTK7AX60YBJyttlb+2VKNiC4E7xDiU5EKnOR uVe2yopW4tyeY0oLQlShqn9O7XOsnSSIvFCK4KDO2jIKe3RFpWYC9fpMtPBaNWH+5QQHfe ErwzcPY3soiU2S8G9dFK8oGvdNCH8UAQS3PbHh60vLMXK+E8RmpvxrdAKbSdNK7QMhIs7o sEeBFK+CYQbXqCoWHFa0apjUKlMA2dyKejNQPDxz28xjCquCTQcLKpR5DVDEfwMkcVZwx7 hiXXxckz4NLOFGDav44QGWIEzbDMLwHsF6YAN5SWmIeweQ/L234wQDuybOelrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731450166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q0//vpoSQN1qoJwycjaQ5Gqo3WRlegmOW/Pq824DYmw=; b=PKDEjRdFcAPX+oe2bEbhS4VAD1y5laaYjZUNiNYf6ezd5oi7YJ6NtP7uCOFK1bsCuHl1DN c0A3WgXBpbfq8zHg1+DnTK2XVid2WsmkvI1qAOb0Vp0n7fluJ7PzCzYJHeARVD7rUmnSRC yo4rQkgmvgqQ+V3iW59wFHsdJpM1AnBgG82P+zPsF6N0Mmyd0K32VyROhDXalxrKnUtoqR ux1bAPppSrSt3+RkO929LdHpr/OE+hCb7Lij3pKIRGPtcBBD4oI4gu6okL35ZHM5t3vmWO WpNCz9BuPzsfkIFik10dPRWQotwp8U5RBtWS0802yfMjbA+6gty0oAVFOObnEg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731450166; a=rsa-sha256; cv=none; b=VK8vK1CCaw9XzR2hyrx5fBIx8nQW+0K549MeTySbmu78UtBKLSZK9Mkd872YGuSu4EKFgb yLTIRXSslxNFs7GwNRIOI2sedL8aAyXAtCE3afeMM+VjiqV3F/t1GqGW5pvxr8nyppK1Up EC0YKdFx57UDlcFpW7+KywDS1gvsSfWjYb/GUZBtOtTKoBhZRF2YKGJQFDHjL5C1JFK8nS y3Gi4KhrddrAOCvrlmUREfCb36bk9agWomJXobtLhUh4DLRsYqAHhvtcLXBlkKkUE1/gqn 2RN6BLz/yoK4YhYjieL5MD0Pbc1Dk5iKqRnn21HyLjJ04aG3ywo29Jm1tScOyQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Xp1BZ2xjJzSHS; Tue, 12 Nov 2024 22:22:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4ACMMkvF089586; Tue, 12 Nov 2024 22:22:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4ACMMkkp089583; Tue, 12 Nov 2024 22:22:46 GMT (envelope-from git) Date: Tue, 12 Nov 2024 22:22:46 GMT Message-Id: <202411122222.4ACMMkkp089583@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Ashish SHUKLA Subject: git: 82100c261bf1 - main - security/vuxml: Document element-web vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ashish X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 82100c261bf1fbf9211ab701a6f45a9ec09ef451 Auto-Submitted: auto-generated The branch main has been updated by ashish: URL: https://cgit.FreeBSD.org/ports/commit/?id=82100c261bf1fbf9211ab701a6f45a9ec09ef451 commit 82100c261bf1fbf9211ab701a6f45a9ec09ef451 Author: Ashish SHUKLA AuthorDate: 2024-11-12 22:17:26 +0000 Commit: Ashish SHUKLA CommitDate: 2024-11-12 22:20:17 +0000 security/vuxml: Document element-web vulnerabilities Security: CVE-2024-51749 Security: CVE-2024-51750 --- security/vuxml/vuln/2024.xml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 455cf03ece90..a7d36c690346 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,40 @@ + + element-web -- several vulnerabilities + + + element-web + 1.11.85 + + + + +

Element team reports:

+
+

Versions of Element Web and Desktop earlier than 1.11.85 do + not check if thumbnails for attachments, stickers and images + are coherent. It is possible to add thumbnails to events + trigger a file download once clicked.

+
+
+

A malicious homeserver can send invalid messages over + federation which can prevent Element Web and Desktop from + rendering single messages or the entire room containing + them.

+
+ + + + CVE-2024-51749 + CVE-2024-51750 + https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2 + https://github.com/element-hq/element-web/security/advisories/GHSA-w36j-v56h-q9pc + + + 2024-11-12 + 2024-11-12 + + + Matrix clients -- mxc uri validation in js sdk