PT-2024-35461 · Unknown · Matrix-Sdk-Crypto

Kasak · Published 2024-01-07 · Updated 2025-02-04 · CVE-2024-52813

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions matrix-sdk-crypto versions prior to 0.8.0

Description The issue concerns a lack of a dedicated mechanism to notify when a user's cryptographic identity changes from verified to unverified, potentially causing client applications to overlook such changes. This could lead to security issues if not properly addressed. The VerificationLevel::VerificationViolation enum variant, introduced in version 0.8.0, indicates that a previously verified identity has been changed.

Recommendations For versions prior to 0.8.0, update to version 0.8.0 or later to include the new VerificationLevel::VerificationViolation enum variant, which provides the necessary notification mechanism for changes in a user's cryptographic identity.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-223

Related Identifiers

CVE-2024-52813

GHSA-R5VF-WF4H-82GG

OPENSUSE-SU-2025:14726-1

RUSTSEC-2024-0434

Affected Products

Matrix-Sdk-Crypto

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52813.json · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2024-0434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5vf-wf4h-82gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52813 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52813 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14726-1 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82gg · Note
• https://github.com/matrix-org/matrix-rust-sdk/pull/3795 · Note
• https://crates.io/crates/matrix-sdk-crypto · Note
• https://twitter.com/CVEnew/status/1876662296656691682 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2024-0434.html · Note
• https://suse.com/security/cve/CVE-2024-52813 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/JAVWAQ2L6YWTYJJN4PNMGZK3GT6FT6T2 · Note