PkgSeer

Vulnerability RUSTSEC-2024-0434

Unknown

2 years ago

Missing facility to signal rotation of a verified cryptographic identity

0.1.0 - 0.7.2

Summary

Missing facility to signal rotation of a verified cryptographic identity

Details

Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.

matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Sending custom to-device messages may panics

0.1.0 - 0.18.0 RUSTSEC-2026-0318

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

0.12.0 - 0.16.0 GHSA-wfq4-36m3-9g42

Sender-binding gaps in to-device messages

0.12.0 - 0.16.0 RUSTSEC-2026-0159

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

0.8.0 - 0.11.0 RUSTSEC-2025-0041

matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

0.8.0 - 0.11.0 GHSA-x958-rvg6-956w

View all vulnerabilities for these packages

Impacted packages

matrix-sdk-crypto

Timeline

Published

2 years ago

Fixed (0.8.0)

1 year ago

Last Modified

1 hour ago