`UserIdentity::is_verified` not checking verification status of own user identity while performing the check

The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. Impact If t...

matrix-qrcode (0.3.0), matrix-sdk-base (>=0.5.0, <=0.5.1) +5 more potentially affected by CVE-2024-40640 via vodozemac (>=0.2.0, <=0.3.0)

vodozemac CARGO version =0.2.0, =0.5.0, =0.3.0, =0.4.0 - matrix-sdk-sled 0.1.0 - matrix-sdk-sql 0.1.0-beta.2 Source cves: CVE-2024-40640 Source advisory: OSV:GHSA-J8CM-G7R6-HFPQ...

matrix-qrcode (0.3.0), matrix-sdk-base (>=0.5.0, <=0.5.1) +5 more potentially affected by CVE-2024-40640 via vodozemac (>=0.2.0, <=0.3.0)

vodozemac CARGO version =0.2.0, =0.5.0, =0.3.0, =0.4.0 - matrix-sdk-sled 0.1.0 - matrix-sdk-sql 0.1.0-beta.2 Source cves: CVE-2024-40640 Source advisory: OSV:RUSTSEC-2024-0354...

GHSA-9GGC-845V-GCGV matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

Introduction In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assign...

CVE-2024-34353 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides ...

CVE-2024-34353

The CVE-2024-34353 issue affects the matrix-sdk-crypto crate (part of the Matrix Rust SDK). A logic bug introduced in a specific commit caused the private part of the server-side backup key pair to be logged at debug time via the tracing crate, potentially exposing sensitive material on affected ...

PT-2024-25810 · Tracing +1 · Tracing +1

Name of the Vulnerable Software and Affected Versions: matrix-sdk-crypto version 0.7.0 matrix-sdk-crypto versions prior to 0.7.1 Description: The issue concerns a logic bug in the matrix-sdk-crypto crate, which is part of the Matrix Rust SDK project. This bug causes the private part of the backup...

alerter (>=0.3.0, <=0.3.1), maruc (0.1.0) +9 more potentially affected by CVE-2024-52813 via matrix-sdk-crypto (>=0.1.0, <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-52813 Source advisory: OSV:RUSTSEC-2024-0434...

Missing facility to signal rotation of a verified cryptographic identity

Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a n...

RUSTSEC-2024-0434 Missing facility to signal rotation of a verified cryptographic identity

Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a n...

PT-2024-35461 · Unknown · Matrix-Sdk-Crypto

Name of the Vulnerable Software and Affected Versions: matrix-sdk-crypto versions prior to 0.8.0 Description: The issue concerns a lack of a dedicated mechanism to notify when a user's cryptographic identity changes from verified to unverified, potentially causing client applications to overlook...

RLSA-2023:1809 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0. Security Fixes: Thunderbird: Revocation status of S/Mime recipient certificates was not checked CVE-2023-0547 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack

The Mozilla Foundation Security Advisory describes this flaw as: Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack

The Mozilla Foundation Security Advisory describes this flaw as: Thunderbird users who use the Matrix chat protocol were vulnerable to a denial-of-service attack...

MGASA-2023-0132 Updated thunderbird packages fix security vulnerability

Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack. CVE-2023-28427...

Updated thunderbird packages fix security vulnerability

Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack. CVE-2023-28427...

DEBIAN-CVE-2022-36059

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data...

SUSE CVE-2022-39236

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the...

USN-5724-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass Content Security Policy CSP or other security restrictions, or execute...