MGASA-2021-0571 - Updated olm packages fix security vulnerability

Publication date: 19 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0571.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-44538

Updated olm packages fix security vulnerability:

The olm_session_describe function in Matrix libolm before 3.2.7 is
vulnerable to a buffer overflow. The Olm session object represents a
cryptographic channel between two parties. Therefore, its state is
partially controllable by the remote party of the channel. Attackerscan construct a crafted sequence of messages to manipulate the state
of the receiver's session in such a way that, for some buffer sizes,
a buffer overflow happens on a call to olm_session_describe.
Furthermore, safe buffer sizes were undocumented. The overflow content
is partially controllable by the attacker and limited to ASCII spaces
and digits (CVE-2021-44538).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29773
- https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44538

SRPMS:
- 8/core/olm-3.2.1-1.1.mga8