matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
### Impact Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. ### Patches matrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed. ### References - Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-52813US | — | — | ||
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/matrix-org/matrix-rust-sdkPACKAGE
- https://github.com/matrix-org/matrix-rust-sdk/pull/3795WEB
- https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82ggWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-52813ADVISORY
- https://rustsec.org/advisories/RUSTSEC-2024-0434.htmlWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan