GitHub Advisoryadvisory · crates.io
GHSA-p2q9-36vw-c468 olm-sys: wrapped library unmaintained, potentially vulnerable
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- olm-sys
- Severity
- High
- Weaknesses
- CWE-1395
- Reviewed
- 2024-09-03
Affected packages
• crates.io olm-sys: <= 1.3.2 (no fix yet)
Description
After several cryptographic vulnerabilities in `libolm` were disclosed publicly, the Matrix Foundation has officially deprecated the library. `olm-sys` is a thin wrapper around `libolm` and is now deprecated and potentially vulnerable in kind.
Users of `olm-sys` and its higher-level abstraction, `olm-rs`, are highly encouraged to switch to `vodozemac` as soon as possible. It is the successor effort to `libolm` and is written in Rust.
Related
Weakness · CWE (1)
- CWE-1395 Dependency on Vulnerable Third-Party Component weakness