1929264 - (CVE-2024-50336) Update matrix-js-sdk to v34.11.0

Status: RESOLVED FIXED

(Chat Core :: Matrix, task)

Description

[Patrick Cloke [:clokep]]

Disclosed today:

We are notifying you of a planned security release of matrix-js-sdk, scheduled for 2024-11-12 to address a Moderate (MATRIXSEC-2021-1083, CVE-2024-50336) severity issue. The fixes will be released in matrix-js-sdk 34.11.0.

Not sure what it will be or if we’ll be affected. We’re currently using v34.3.1 on Daily and v31.4.0 on ESR 128.

Comment 1

[Martin Giger [:freaktechnik]]

Attachment: Bug 1929264 - Update matrix-js-sdk to v34.11.1. r=clokep

Also bump dependencies

Comment 2

[Martin Giger [:freaktechnik]]

The vulnerability affects us for links to attachments and the URLs we use to load avatars for users and rooms. The avatars are if anything the more important vector probably, though I'd expect it to be less useful since we load them as images (so we only make a flat GET request).

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/9b5b6cefd84e
Update matrix-js-sdk to v34.11.1. r=clokep

Comment 4

[Corey Bryant]

It sounds like we'll need a CVE for Thunderbird. I'm happy to help put that together once we have enough details. Would it be sec-moderate in line with CVE-2024-50336?

Comment 5

[Patrick Cloke [:clokep]]

(In reply to Corey Bryant from comment #4)

It sounds like we'll need a CVE for Thunderbird.

I think we reuse CVE numbers for libraries.

I think sec-moderate sounds correct.

We need to figure out if we want to back port this somehow, options might be to back port the full update or to try to patch the js-sdk on ESR with just the security fix, or stop calling the affected function on EST. I don’t think we’ve usually backported patches of dependencies before, but doesn’t sound too bad in this case.

Martin — any opinions as the person who did the initial patch?

Comment 6

[Martin Giger [:freaktechnik]]

I agree, moderate sounds appropriate.

In regards to uplifting to ESR, I think uplifting the individual matrix updates should be doable fairly cleanly. There haven't been changes in the chat code for matrix apart from the updates as far as I remember.
I'm not very keen on applying custom patches on a vendored library unless there's no other way. Doing that would also make future uplifts harder.

Comment 7

[Patrick Cloke [:clokep]]

Attachment: v33.1.0-v34.3.0-v34.3.1-v34.11.1.patch

I've checked and revisions 24b12914ba96, 9ae3d2c5a217, 887b910190f5, and 9b5b6cefd84e apply cleanly to comm-esr128. I've uploaded a (single) patch which cats those patches together for uplift.

[Approval Request Comment]
Regression caused by (bug #): N/A
User impact if declined: Potential security impact on comm-esr128
Testing completed (on c-c, etc.): These patches have all landed on comm-central
Risk to taking this patch (and alternatives if risky): Potential security impact on comm-esr128

Note that I don't have a comm-esr128 environment setup right now so I wasn't able to test this locally.

Comment 8

[Corey Bryant]

Patrick, We could target 128.5.2esr for this (Dec 10). Do you plan to do any testing?

Comment 9

[Corey Bryant]

Comment on attachment 9440063 [details] [diff] [review]
v33.1.0-v34.3.0-v34.3.1-v34.11.1.patch

[Triage Comment]
Approved for esr128

Comment 10

[Daniel Darnell [:dandarnell]]

Thunderbird 128.5.2esr:
https://hg.mozilla.org/releases/comm-esr128/rev/c1ab83f1aa52

Comment 11

[Patrick Cloke [:clokep]]

We chatted about this over Matrix and 128.5.2esr sounded good. Thank you for taking care of this!