CVE-2024-52813: falha de média gravidade em matrix-org matrix-rust-sdk
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.5%
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
matrix-org · matrix-rust-sdkCVEs relacionadas — matrix-org matrix-rust-sdk
No mesmo produto, das mais perigosas para as menos.
CVE-2022-39252HIGHWhen matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarderEPSS 0.6%CVE-2025-66622LOWmatrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuesEPSS 0.4%CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%CVE-2025-48937MEDIUMmatrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administratorEPSS 0.4%CVE-2025-53549MEDIUMMatrix Rust SDK allows SQL injection in the EventCache implementationEPSS 0.3%CVE-2026-45056MEDIUMMatrix Rust SDK: Sender-binding gaps in to-device and room-key attributionEPSS 0.3%