GHSA-r5vf-wf4h-82gg CVE-2024-52813 RUSTSEC-2024-0434
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 42.16% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-223 Omission of Security-relevant Information
- CWE-347 Improper Verification of Cryptographic Signature
- Fix
0.8.0- Upgrade matrix-sdk-crypto to this version or later
Description
Impact
Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.
Patches
matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
References
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| matrix-sdk-crypto | < 0.8.0 |
0.8.0 |
| matrix-sdk-crypto | >= 0.0.0-0, < 0.8.0 |
0.8.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
matrix-sdk-crypto crates.io → 0.8.0
- cargo
cargo update -p matrix-sdk-crypto --precise 0.8.0
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-223: Omission of Security-relevant Information
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0318 Sending custom to-device messages may panics | Not rated yet | Also affects matrix-sdk-crypto |
| GHSA-wfq4-36m3-9g42 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution | Medium | Also affects matrix-sdk-crypto |
| GHSA-x958-rvg6-956w matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator | Medium | Also affects matrix-sdk-crypto |
| GHSA-4qg4-cvh2-crgg matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check | Medium | Also affects matrix-sdk-crypto |
| GHSA-9ggc-845v-gcgv matrix-sdk-crypto contains a log exposure of private key of the server-side key backup | Medium | Also affects matrix-sdk-crypto |
| GHSA-vp68-2wrm-69qm matrix-sdk-crypto contains potential impersonation via room key forward responses | High | Also affects matrix-sdk-crypto |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor