GitHub Advisoryadvisory · crates.io

GHSA-p2q9-36vw-c468 olm-sys: wrapped library unmaintained, potentially vulnerable

HIGH Published 2024-09-03 Modified 2024-09-03 Official page ↗
Ecosystem
crates.io
Packages
olm-sys
Severity
High
Weaknesses
CWE-1395
Reviewed
2024-09-03

Affected packages

• crates.io olm-sys: <= 1.3.2 (no fix yet)

Description

After several cryptographic vulnerabilities in `libolm` were disclosed publicly, the Matrix Foundation has officially deprecated the library. `olm-sys` is a thin wrapper around `libolm` and is now deprecated and potentially vulnerable in kind. Users of `olm-sys` and its higher-level abstraction, `olm-rs`, are highly encouraged to switch to `vodozemac` as soon as possible. It is the successor effort to `libolm` and is written in Rust.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References