CVE-2024-40648: matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check
(updated )
The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn’t take into account the verification status of the user’s own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.
References
- github.com/advisories/GHSA-4qg4-cvh2-crgg
- github.com/matrix-org/matrix-rust-sdk
- github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a
- github.com/matrix-org/matrix-rust-sdk/releases/tag/0.7.2-crypto
- github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-4qg4-cvh2-crgg
- nvd.nist.gov/vuln/detail/CVE-2024-40648
- rustsec.org/advisories/RUSTSEC-2024-0356.html
Code Behaviors & Features
Detect and mitigate CVE-2024-40648 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →