CVE-2024-52813CWE-223

matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

Medium · published January 7, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.2th percentile
Weakness
CWE-223 · Omission of Security-relevant Information
Published
2025-01-07T15:25Z
EPSS history
Timeline
  • 07 JAN 15:25Z
    matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
    cvelistv5