PT-2024-25810 · Tracing+1 · Tracing+1

Kasak · Published 2024-05-13 · Updated 2024-05-14 · CVE-2024-34353

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions matrix-sdk-crypto version 0.7.0 matrix-sdk-crypto versions prior to 0.7.1

Description The issue concerns a logic bug in the matrix-sdk-crypto crate, which is part of the Matrix Rust SDK project. This bug causes the private part of the backup key pair to be logged to Rust debug logs using the tracing crate. The key backup is used for storing encrypted copies of Matrix message keys, facilitating key sharing between devices and providing a redundant copy in case devices are lost. It utilizes asymmetric cryptography with unique public-private key pairs for each server-side key backup.

Recommendations For matrix-sdk-crypto version 0.7.0, update to version 0.7.1 to resolve the issue. As a temporary workaround, consider disabling the logging feature in the tracing crate until the update to version 0.7.1 is applied.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-34353

GHSA-9GGC-845V-GCGV

Affected Products

Matrix-Sdk-Crypto

Tracing

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34353.json · Exploit
• https://osv.dev/vulnerability/GHSA-9ggc-845v-gcgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34353 · Security Note
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/commit/71136e44c03c79f80d6d1a2446673bc4d53a2067 · Note
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-9ggc-845v-gcgv · Note
• https://github.com/matrix-org/matrix-rust-sdk/commit/fa10bbb5dd0f9120a51aa1854cec752e25790bb0 · Note
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-crypto-0.7.1 · Note
• https://crates.io/crates/matrix-sdk-crypto/0.7.1 · Note
• https://twitter.com/CVEnew/status/1790047134315847939 · Twitter Post