p PatchFirst

GHSA-wchh-9x6h-7f6p

GHSA-wchh-9x6h-7f6p · olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers. Olm is a dependency of `matrix-commander` (Python version, not Rust version). WARNING: Due to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue. ### References - CVE-2022-39255 - CVE-2024-45193 - https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ - https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193 - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm ### Workarounds - use the Rust version: https://github.com/8go/matrix-commander-rs ### Severity: Medium CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium). CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • matrix-commander PyPI

    Versiones
    • 2.16.0
    • 2.17.0
    • 2.18.0
    • 2.19.0
    • 2.20.0
    • 2.21.0
    • 2.23.0
    • 2.24.0
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.34.0
    • 2.34.1
    • 2.35.0
    • 2.36.0
    • 2.37.0
    • 2.38.0
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.4.0
    • 3.5.0
    • 3.5.19
    • 3.5.24
    • 3.5.25
    • 3.5.26
    • 3.5.27
    • 4.0.0
    • 5.0.0
    • 5.1.0
    • 5.2.0
    • 6.0.0
    • 6.0.1
    • 6.0.2
    • 7.0.0
    • 7.1.0
    • 7.2.0
    • 7.3.0
    • 7.3.1
    • 7.4.0
    • 7.5.0
    • 7.6.0
    • 7.6.1
    • 7.6.2
    • 7.6.3
    • 7.7.0
    • 7.7.1
    • 8.0.0
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    Intervalos de versiones afectados
    • ECOSYSTEM: ≤ 8.0.6

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →