x/vulndb: potential Go vuln in github.com/t2bot/matrix-media-repo: CVE-2024-36402

[GoVulnBot]

Advisory CVE-2024-36402 references a vulnerability in the following Go modules:

Module
github.com/t2bot/matrix-media-repo

Description:
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-36402
• FIX: MSC3916: Authentication for media matrix-org/matrix-spec-proposals#3916
• WEB: GHSA-8vmr-h7h5-cqhg

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/t2bot/matrix-media-repo
      vulnerable_at: 1.3.8
summary: CVE-2024-36402 in github.com/t2bot/matrix-media-repo
cves:
    - CVE-2024-36402
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-36402
    - fix: https://github.com/matrix-org/matrix-spec-proposals/pull/3916
    - web: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg
source:
    id: CVE-2024-36402
    created: 2025-01-16T21:01:19.33961206Z
review_status: UNREVIEWED

[zpavlinovic]

Duplicate of #3397