medium4.3
CVE-2024-52813
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
Impact
### Impact Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. ### Patches matrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed. ### References - Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | matrix-sdk-crypto | < 0.8.0 | 0.8.0 |
Affected products
| Product | Affected versions |
|---|---|
| Matrix-Sdk-Crypto Rust Crate | before 0.8.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/matrix-org/matrix-rust-sdk/pull/3795
- https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82gg
- https://github.com/advisories/GHSA-r5vf-wf4h-82gg
- https://nvd.nist.gov/vuln/detail/CVE-2024-52813
- https://rustsec.org/advisories/RUSTSEC-2024-0434.html