Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / pypi/matrix-commander/GHSA-wchh-9x6h-7f6p
Advisory ID gitlab/pypi/matrix-commander/GHSA-wchh-9x6h-7f6p
Aliases GHSA-wchh-9x6h-7f6p
Summary olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193 ### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers. Olm is a dependency of `matrix-commander` (Python version, not Rust version). WARNING: Due to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue. ### References - CVE-2022-39255 - CVE-2024-45193 - https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ - https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193 - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm ### Workarounds - use the Rust version: https://github.com/8go/matrix-commander-rs ### Severity: Medium CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium). CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1395 Dependency on Vulnerable Third-Party Component
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979
https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p
https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626
https://github.com/matrix-nio/matrix-nio/pull/555
GHSA-wchh-9x6h-7f6p https://github.com/advisories/GHSA-wchh-9x6h-7f6p
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.