Vulnerability · Published Jan 7, 2025 · Assigned by GitHub_M

CVE-2024-52813matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

Medium 4.3

In plain English

A medium-severity security flaw in matrix-rust-sdk from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.

Affected products (as reported)

Vendor	Product	Versions
matrix-org	matrix-rust-sdk	< 0.8.0

Weakness: CWE-223 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82gg x_refsource_CONFIRM
https://github.com/matrix-org/matrix-rust-sdk/pull/3795 x_refsource_MISC