CVE-2022-41904: Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions
Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Element iOSto a version that resolves this vulnerability.Fixed in 1.9.7
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41904?
CVE-2022-41904 is classified as a high severity vulnerability due to the potential for information injection by a malicious homeserver.
How do I fix CVE-2022-41904?
To fix CVE-2022-41904, upgrade Element iOS to version 1.9.7 or later.
What is the impact of CVE-2022-41904?
The impact of CVE-2022-41904 allows a malicious homeserver to inject misleading encrypted events, compromising user trust.
Which versions of Element iOS are affected by CVE-2022-41904?
Element iOS versions prior to 1.9.7 are affected by CVE-2022-41904.
What type of vulnerability is CVE-2022-41904?
CVE-2022-41904 is a security vulnerability related to the handling of encrypted events in Element iOS.