PT-2024-28965 · Unknown · Matrix-Sdk-Crypto

Dkasak · Published 2024-07-18 · Updated 2024-07-30 · CVE-2024-40648

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions matrix-sdk-crypto versions prior to 0.7.2

Description The UserIdentity::is verified() method in the matrix-sdk-crypto crate does not take into account the verification status of the user's own identity while performing the check, potentially returning a value contrary to what is implied by its name and documentation. If this method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome to make the identity appear trusted. However, this is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate.

Recommendations For versions prior to 0.7.2, upgrade to version 0.7.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the UserIdentity::is verified() method to decide whether to perform sensitive operations towards a user identity until the issue is resolved.

Exploit

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CVE-2024-40648

GHSA-4QG4-CVH2-CRGG

OPENSUSE-SU-2024:14224-1

RUSTSEC-2024-0356

Affected Products

Matrix-Sdk-Crypto

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40648.json · Exploit
• https://osv.dev/vulnerability/GHSA-4qg4-cvh2-crgg · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0356 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40648 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14224-1 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/0.7.2-crypto · Note
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-4qg4-cvh2-crgg · Note
• https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a · Note
• https://crates.io/crates/matrix-sdk-crypto · Note
• https://t.me/cvedetector/1163 · Telegram Post
• https://suse.com/security/cve/CVE-2024-40648 · Note
• https://rustsec.org/advisories/RUSTSEC-2024-0356.html · Note