CVE-2024-52813

Description

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.

Reserved 2024-11-15 | Published 2025-01-07 | Updated 2025-01-07 | Assigner GitHub_M

Problem types

CWE-223: Omission of Security-relevant Information

Product status

< 0.8.0
affected

References

github.com/...st-sdk/security/advisories/GHSA-r5vf-wf4h-82gg

github.com/matrix-org/matrix-rust-sdk/pull/3795

cve.org (CVE-2024-52813)

nvd.nist.gov (CVE-2024-52813)

Download JSON