GitHub Advisoryadvisory · crates.io

GHSA-r5vf-wf4h-82gg matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

MEDIUM Published 2025-01-07 Modified 2025-01-22 Official page ↗
Aliases
CVE-2024-52813
Ecosystem
crates.io
Packages
matrix-sdk-crypto
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-223, CWE-347
Reviewed
2025-01-07

Affected packages

• crates.io matrix-sdk-crypto: < 0.8.0 → fixed in 0.8.0

Description

Impact Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. Patches matrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed. References • Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795

Related

Alias · CVE (1)

  • CVE-2024-52813 matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. vulnerability

Weakness · CWE (2)

  • CWE-223 Omission of Security-relevant Information weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References