diff --git a/advisories/github-reviewed/2025/01/GHSA-r5vf-wf4h-82gg/GHSA-r5vf-wf4h-82gg.json b/advisories/github-reviewed/2025/01/GHSA-r5vf-wf4h-82gg/GHSA-r5vf-wf4h-82gg.json index c9c6c43bbb1..fcc0cd10267 100644 --- a/advisories/github-reviewed/2025/01/GHSA-r5vf-wf4h-82gg/GHSA-r5vf-wf4h-82gg.json +++ b/advisories/github-reviewed/2025/01/GHSA-r5vf-wf4h-82gg/GHSA-r5vf-wf4h-82gg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-r5vf-wf4h-82gg", - "modified": "2025-01-07T18:39:25Z", + "modified": "2025-01-22T17:37:49Z", "published": "2025-01-07T15:25:52Z", "aliases": [ "CVE-2024-52813" ], "summary": "matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity", - "details": "### Impact\n\nVersions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.\n\n### Patches\n\nmatrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed.\n\n### Workarounds\n\nN/A\n\n### References\n\n- Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795\n", + "details": "### Impact\n\nVersions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes.\n\n### Patches\n\nmatrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation` enum variant which indicates that a previously verified identity has been changed.\n\n### References\n\n- Patch: https://github.com/matrix-org/matrix-rust-sdk/pull/3795\n", "severity": [ { "type": "CVSS_V3", @@ -51,6 +51,10 @@ { "type": "PACKAGE", "url": "https://github.com/matrix-org/matrix-rust-sdk" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0434.html" } ], "database_specific": {