PT-2024-31475 · Unknown+1 · Matrix Libolm+1

Soatok · Published 2024-08-22 · Updated 2024-09-10 · CVE-2024-45192

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Matrix libolm versions through 3.2.16

Description An issue was discovered in Matrix libolm, where cache-timing attacks can occur due to the use of base64 when decoding group session keys. This vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For Matrix libolm versions through 3.2.16, consider switching to vodozemac as soon as possible, as it is the successor effort to libolm and is written in Rust. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-385

Related Identifiers

CVE-2024-45192

RUSTSEC-2024-0368

Affected Products

Debian

Matrix Libolm

References · 22

• 🔥 https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library · Exploit
• https://osv.dev/vulnerability/CVE-2024-45192 · Vendor Advisory
• https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-45192 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0368 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45192 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45192 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-45192 · Security Note
• https://ubuntu.com/security/CVE-2024-45192 · Vendor Advisory
• https://t.me/cvenotify/92969 · Telegram Post
• https://gitlab.matrix.org/matrix-org/olm · Note
• https://twitter.com/VulmonFeeds/status/1826701726168027375 · Twitter Post
• https://t.me/cvenotify/94073 · Telegram Post
• https://twitter.com/CVEnew/status/1826645463316987992 · Twitter Post