{"id":105214,"date":"2022-09-29T15:36:37","date_gmt":"2022-09-29T13:36:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah"},"modified":"2022-09-29T15:36:37","modified_gmt":"2022-09-29T13:36:37","slug":"kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","title":{"rendered":"Kriitilised haavatavused, mis ohustavad tugevat kr\u00fcptimist paljudes Matrixi klientides.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Decentraliseeritud suhtluse platvormi Matrix arendajad on hoiatanud, et matrix-js-sdk, matrix-ios-sdk ja matrix-android-sdk2 teekides on tuvastatud kriitilised haavatavused, mis v\u00f5imaldavad serveri administraatoritel end teiste kasutajatena esitleda ja lugeda end-to-end kr\u00fcpteeritud (E2EE) vestluste s\u00f5numeid. Need haavatavused tulenevad protokolli Matrix kahe erinevast rakendusest esinevatest vigadest ega ole protokolli enda probleem. Praegu on projekt v\u00e4lja andnud probleemsete SDK-de v\u00e4rskendused ja nende p\u00f5hjal ehitatud klientrakenduste osade v\u00e4rskendused.    <\/p>\n<p>Eduka r\u00fcnnaku jaoks on vajalik p\u00f6\u00f6rduda r\u00fcndaja kontrolli all oleva <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-shicago\/\"   title=\"serveri\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2922\">serveri<\/a> (homeserver \u2014 server for storing client history and accounts). Client-side end-to-end encryption prevents the administrator from accessing <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3857\">serverilt<\/a> vestlusesse sekkuda, kuid tuvastatud haavatavused annavad v\u00f5imaluse seda kaitset k\u00f5rvale hiilida. Probleemid m\u00f5jutavad p\u00f5hitegemise Matrixi klienti Element (endine Riot) Veebis, lauaarvutites, iOS- ja Android-seadmetes, samuti kolmandate osapoolte klientrakendusi, sealhulgas Cinny, Beeper, SchildiChat, Circuli ja Synod.im. Haavatavused ei avaldu matrix-rust-sdk, hydrogen-sdk, Matrix Dart SDK, mautrix-python, mautrix-go ja matrix-nio teekides ega ka rakendustes Hydrogen, ElementX, Nheko, FluffyChat, Syphon, Timmy, Gomuks ja Pantalaimon.      <\/p>\n<p>Tuvatavat kolme peamist r\u00fcnnakuskeemi:  <\/p>\n<ul>\n<li class=\"l\"> Matrix-serveri administraator v\u00f5ib rikkuda emoji p\u00f5hjal toimuva autentimise (SAS, l\u00fchikesed autentimisteated) verifitseerimist ristallkirjade kasutamisel ja esineda teise kasutajana. Probleem tuleneb haavatavusest (CVE-2022-39250) matrix-js-sdk koodis, mis on seotud seadme identifikaatorite ja ristallkirjade v\u00f5tmete t\u00f6\u00f6tlemise segamisega.\n<li class=\"l\"> Serverit kontrolliv r\u00fcndaja v\u00f5ib valetada usaldusv\u00e4\u00e4rse saatja ja edastada vale v\u00f5tme, et vahepeal edastada s\u00f5numeid teistelt kasutajatelt. Probleem tuleneb haavatavusest matrix-js-sdk-s (CVE-2022-39251), matrix-ios-sdk-s (CVE-2022-39255) ja matrix-android-sdk2-s (CVE-2022-39248), mis pani kliendi valesti vastu v\u00f5tma seadmetele adresseeritud s\u00f5numeid, mis oli kr\u00fcpteeritud Megolm protokolli, mitte Olmi, kaudu, omistades s\u00f5numid Megolm saatjale, mitte tegelikule saatjale.\n<li class=\"l\"> Kasutades eelmainitud haavatavusi, saab serveri administraator lisada kasutaja kontole vale varukoha v\u00f5tme, et hankida s\u00f5numite \u0161ifreerimiseks kasutatavad v\u00f5tmed.    <\/ul>\n<p>Researchers who discovered the vulnerability also demonstrated attacks that result in adding an unauthorized user to a chat or attaching another device to a user. These attacks are based on the fact that the service messages used to add users to a chat are not linked to the chat creator's keys and can be generated by the server administrator. Developers from the Matrix project classified these vulnerabilities as minor, as such manipulations would not go unnoticed \u2014 in the case of substituting a user, they will appear in the chat user list, and adding a device will trigger a warning, with the device marked as unverified (immediately after adding the substituted device, the shared keys necessary for decrypting messages will start being transmitted).<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57844\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u0434\u0430\u0432\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u0447\u0430\u0442\u0430\u0445 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c (E2EE). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Matrix \u0438 \u043d\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f, \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 SDK [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105214","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Matrix-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-09-29T13:36:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-09-29T13:36:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitilised haavatavused, mis ohustavad l\u00f5pp-otsast l\u00f5pp-otsani \u0161ifreeringut paljude Matrix kliente | ProHoster","description":"Detsentraliseeritud kommunikatsioonide platvormi Matrix arendajad hoiatavad matrix-js-sdk, matrix-ios-sdk ja matrix-android-sdk2 teekides tuvastatud kriitiliste haavatavuste kohta, mis v\u00f5imaldavad serveri administraatoritel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Matrix-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-09-29T13:36:37+00:00","article:modified_time":"2022-09-29T13:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"105214","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:04","updated":"2026-02-22 15:31:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105214"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105214\/revisions"}],"predecessor-version":[{"id":162385,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105214\/revisions\/162385"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}