--- title: "CVE-2022-36059\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2022-36059?format=md keywords: index, follow --- # CVE-2022-36059 Publication date 1 September 2022 Last updated 11 July 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **8.2 · High** [Score breakdown](https://ubuntu.com/security/CVE-2022-36059?format=md#impact-score) Toggle side navigation ## Description matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | node-matrix-js-sdk | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Ignored end of life, was needs-triage | | 24.04 LTS noble | Needs evaluation | | 23.10 mantic | Ignored end of life, was needs-triage | | 23.04 lunar | Ignored end of life, was needs-triage | | 22.10 kinetic | Ignored end of life, was needs-triage | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Ignored end of standard support, was needs-triage | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | thunderbird | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Ignored end of life, was needs-triage | | 22.04 LTS jammy | Fixed 1:102.2.2+build1-0ubuntu0.22.04.1 | | 20.04 LTS focal | Fixed 1:102.2.2+build1-0ubuntu0.20.04.1 | | 18.04 LTS bionic | Fixed 1:102.2.2+build1-0ubuntu0.18.04.1 | | 16.04 LTS xenial | Ignored end of standard support | | 14.04 LTS trusty | Ignored end of standard support | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 8.2 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | Low | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 8.2 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-36059) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-36059) * [Debian](https://security-tracker.debian.org/tracker/CVE-2022-36059) ### Related Ubuntu Security Notices (USN) + [USN-5663-1](https://usn.ubuntu.com/USN-5663-1) + Thunderbird vulnerabilities + 7 October 2022 ### Other references * * * *