Dendrite signature checks not applied to some retrieved missing events
Description
Published by the National Vulnerability Database
Sep 12, 2022
Published to the GitHub Advisory Database
Sep 15, 2022
Reviewed
Sep 15, 2022
Last updated
Feb 2, 2023
Impact
Events retrieved from a remote homeserver using
/get_missing_events
did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.Note that this does not apply to events retrieved through other endpoints (e.g.
/event
,/state
) as they have been correctly verified.Homeservers that have federation disabled are not vulnerable.
Patches
The problem has been fixed in Dendrite 0.9.8.
Workarounds
There are no workarounds.
Special thanks
Tulir Asokan, who spotted the issue originally.
References