CVE-2024-34063

Katalog CVE

CVSS 2.5 · Low EPSS 0,14%

Kerentanan Initialization of a Resource with an Insecure Default. Skor CVSS 3.1 2.5 (Low) menurut github.com.

Deskripsi (NVD)

vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

3 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

2.5 (Low), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9
• https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-g5c6