matrix-org / matrix-org/matrix-js-sdk

CVE-2023-28427 fixes leave state unable to sync

Open
#3,637 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
2.2k
Forks
704
Avg merge
1d 20h
Merged PRs (30d)
40

Description

Originally reported at https://github.com/cinnyapp/cinny/issues/1179 as I was unable to repro syncing an element client even after upgrade, but today realized the issue also appears on element, but only if syncing a new element login from scratch.

On Element Web 1.11.35, I see the following trying to sync fresh, which as a result leaves only about 10% of chats loaded and the rest don't receive messages and don't appear in the UI.

```
aught /sync error Error: Unable to encrypt with m.megaolm.v1.aes-sha2
setRoomEncryptionImpl index.ts:2689
onCryptoEvent index.ts:3081
processSyncResponse sync.ts:1431
L utils.ts:425
processSyncResponse sync.ts:1293
doSync sync.ts:915
sync sync.ts:798
startClient client.ts:1515
start MatrixClientPeg.ts:334
me Lifecycle.ts:818
ie Lifecycle.ts:639
te Lifecycle.ts:460
$ Lifecycle.ts:147
loadSession MatrixChat.tsx:496
promise callback*loadSession MatrixChat.tsx:495
Ye MatrixChat.tsx:343
promise callback*Ye MatrixChat.tsx:323
React 13
oe init.tsx:150
async* SecretSharing.ts:185
async* SecretSharing.ts:198
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing a fresh Element Web login on version 1.11.35 and inspect the sync failure around index.ts, sync.ts, and client.ts named in the stack trace. Done means the m.megaolm.v1.aes-sha2 error no longer stops synchronization and all chats load and receive messages.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.