RUSTSEC-2024-0356 (CVE-2024-40648)

Vulnerability from osv_rustsec – Published: 2024-07-18 12:00 – Updated: 2024-07-19 10:11 – Source website
VLAI
Summary
`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
Details

The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.

Impact

If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "matrix_sdk_crypto::UserIdentity::is_verified"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "matrix-sdk-crypto",
        "purl": "pkg:cargo/matrix-sdk-crypto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.7.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2024-40648",
    "GHSA-4qg4-cvh2-crgg"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before\nversion 0.7.2 doesn\u0027t take into account the verification status of the user\u0027s\nown identity while performing the check and may as a result return a value\ncontrary to what is implied by its name and documentation.\n\n## Impact\n\nIf the method is used to decide whether to perform sensitive operations towards\na user identity, a malicious homeserver could manipulate the outcome in order to\nmake the identity appear trusted. This is not a typical usage of the method,\nwhich lowers the impact. The method itself is not used inside the\nmatrix-sdk-crypto crate.",
  "id": "RUSTSEC-2024-0356",
  "modified": "2024-07-19T10:11:38Z",
  "published": "2024-07-18T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/matrix-sdk-crypto"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0356.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-4qg4-cvh2-crgg"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`UserIdentity::is_verified` not checking verification status of own user identity while performing the check"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.