CVE-2024-52813

CVE-2024-52813 concerns matrix-sdk-crypto in the matrix-rust-sdk. Version pre-0.8.0 lacks a dedicated mechanism to notify when a user’s cryptographic identity changes from verified to unverified, potentially causing clients to overlook such changes. The fix introduced in 0.8.0 adds a new Verifica...

CVE-2024-52813 matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applicatio...

GHSA-F83W-WQHC-CFP4 Matrix SDK for React's URL preview setting for a room is controllable by the homeserver

Impact A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. Even if the CVSS score would be 4.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N the...

Matrix SDK for React's URL preview setting for a room is controllable by the homeserver

Impact A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. Even if the CVSS score would be 4.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N the...

CVE-2024-40648

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result retur...

CVE-2024-40648 `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result retur...

CVE-2024-40648 `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result retur...

CVE-2024-40648

CVE-2024-40648 affects matrix-rust-sdk via matrix-sdk-crypto: the UserIdentity::is_verified() check in versions before 0.7.2 does not consider the user’s own verification status, potentially yielding a value that contradicts its name. The flaw is not used inside matrix-sdk-crypto itself, and the ...

alerter (>=0.3.0 <=0.3.1), maruc (=0.1.0) +9 more potentially affected by CVE-2024-40648 via matrix-sdk-crypto (>=0.1.0 <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-40648 Source advisory: OSV:GHSA-4QG4-CVH2-CRGG...

GHSA-4QG4-CVH2-CRGG matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. Impact If t...

matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. Impact If t...

alerter (>=0.3.0 <=0.3.1), maruc (=0.1.0) +9 more potentially affected by CVE-2024-40648 via matrix-sdk-crypto (>=0.1.0 <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-40648 Source advisory: OSV:RUSTSEC-2024-0356...

RUSTSEC-2024-0356 `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. Impact If t...

`UserIdentity::is_verified` not checking verification status of own user identity while performing the check

The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. Impact If t...

matrix-qrcode (=0.3.0), matrix-sdk-base (>=0.5.0 <=0.5.1) +5 more potentially affected by CVE-2024-40640 via vodozemac (>=0.2.0 <=0.3.0)

vodozemac CARGO version =0.2.0, =0.5.0, =0.3.0, =0.4.0 - matrix-sdk-sled =0.1.0 - matrix-sdk-sql =0.1.0-beta.2 Source cves: CVE-2024-40640 Source advisory: OSV:GHSA-J8CM-G7R6-HFPQ...

GHSA-9GGC-845V-GCGV matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

Introduction In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assign...

CVE-2024-34353

The CVE-2024-34353 issue affects the matrix-sdk-crypto crate (part of the Matrix Rust SDK). A logic bug introduced in a specific commit caused the private part of the server-side backup key pair to be logged at debug time via the tracing crate, potentially exposing sensitive material on affected ...

CVE-2024-34353 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides ...

PT-2024-25810 · Tracing +1 · Tracing +1

Name of the Vulnerable Software and Affected Versions: matrix-sdk-crypto version 0.7.0 matrix-sdk-crypto versions prior to 0.7.1 Description: The issue concerns a logic bug in the matrix-sdk-crypto crate, which is part of the Matrix Rust SDK project. This bug causes the private part of the backup...

alerter (>=0.3.0 <=0.3.1), maruc (=0.1.0) +9 more potentially affected by CVE-2024-52813 via matrix-sdk-crypto (>=0.1.0 <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-52813 Source advisory: OSV:RUSTSEC-2024-0434...