Bug 906108 (CVE-2023-28317, CVE-2023-28318)

Summary:	net-im/rocketchat-desktop-bin: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	trivial	CC:	maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [??]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-05-11 04:24:31 UTC

CVE-2023-28318 (https://hackerone.com/reports/1379451):

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices.

CVE-2023-28317 (https://hackerone.com/reports/1379635):

A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.

These are ostensibly fixed, but it doesn't seem that Hackerone is advertising this information.