x/vulndb: potential Go vuln in github.com/matrix-org/dendrite: CVE-2022-39200

[GoVulnBot]

CVE-2022-39200 references github.com/matrix-org/dendrite, which may be a Go module.

Description:
Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the /get_missing_events path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. /event, /state) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-39200
• JSON: https://github.com/CVEProject/cvelist/tree/baafaa9b43ade24da6a33c1f7d2bbe029c8bdf96/2022/39xxx/CVE-2022-39200.json
• web: GHSA-pfw4-xjgm-267c
• fix: matrix-org/dendrite@2792d04
• Imported by: https://pkg.go.dev/github.com/matrix-org/dendrite?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/matrix-org/dendrite
    packages:
      - package: dendrite
description: |
    Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
cves:
  - CVE-2022-39200
references:
  - web: https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c
  - fix: https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3

[zpavlinovic]

https://github.com/matrix-org/dendrite is a binary not imported by anyone. The fix is an internal package used by a non-internal package that is also not imported by anyone (that is, it used to be imported by one module that is now gone). The fixed symbol leads to nowhere. This is effectively not importable.

[gopherbot]

Change https://go.dev/cl/431537 mentions this issue: data/excluded: add GO-2022-0989.yaml for CVE-2022-39200

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607230 mentions this issue: data/reports: unexclude 20 reports (28)