PT-2024-25675 · Dalek+1 · Dalek+1

Dkasak · Published 2024-05-02 · Updated 2024-06-15 · CVE-2024-34063

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions vodozemac versions 0.5.0 through 0.5.1

Description The issue is related to degraded secret zeroization capabilities in vodozemac, due to changes in third-party cryptographic dependencies, specifically the Dalek crates. This could result in the production of more memory copies of encryption secrets and secrets lingering in memory longer than necessary, marginally increasing the risk of sensitive data exposure. The impact of this issue is considered low, as the inherent limitations of Rust regarding absolute zeroization reduce the practical severity of this lapse.

Recommendations For versions 0.5.0 and 0.5.1, upgrade to version 0.6.0 to address the issue. At the moment, there are no known workarounds for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2024-34063

GHSA-C3HM-HXWF-G5C6

OPENSUSE-SU-2024:14009-1

RUSTSEC-2024-0342

Affected Products

Dalek

Vodozemac

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34063.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34063 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14009-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3hm-hxwf-g5c6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34063 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0342 · Vendor Advisory
• https://github.com/matrix-org/vodozemac · Note
• https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9 · Note
• https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-g5c6 · Note
• https://suse.com/security/cve/CVE-2024-28854 · Note
• https://crates.io/crates/vodozemac · Note
• https://suse.com/security/cve/CVE-2024-34063 · Note
• https://twitter.com/CVEnew/status/1786408497648746915 · Twitter Post
• https://t.me/cvenotify/79020 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2024-0342.html · Note