Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified by GHSA-wchh-9x6h-7f6p, is not in the matrix-commander project itself, but in its dependency, matrix-nio, which in turn used the vulnerable libolm library. The libolm library has several documented cryptographic vulnerabilities (CVE-2022-39255, CVE-2024-45193), including timing side-channel attacks, signature malleability, and other issues.
The provided patch, a commit in the matrix-nio repository, addresses these vulnerabilities by performing a wholesale replacement of the olm cryptographic library with a more secure alternative, vodozemac. The analysis of the commit shows that the core cryptographic functions responsible for key management, session creation, encryption, and decryption have been rewritten to use vodozemac.
The identified vulnerable functions are the methods in matrix-nio that directly invoked the insecure functions from the olm library. During runtime, these are the functions that would be processing cryptographic material and would be susceptible to the underlying vulnerabilities in libolm. An attacker could have exploited these to compromise message confidentiality or integrity. The patch mitigates this by removing the dependency on the vulnerable library entirely.
nio.crypto.olm_machine.OlmMachine._olm_encryptsrc/nio/crypto/olm_machine.py
nio.crypto.olm_machine.OlmMachine._try_decryptsrc/nio/crypto/olm_machine.py
nio.crypto.sas.Sas.set_their_pubkeysrc/nio/crypto/sas.py
nio.crypto.sessions.OlmAccount.from_picklesrc/nio/crypto/sessions.py
nio.crypto.sessions.InboundSession.decryptsrc/nio/crypto/sessions.py
nio.crypto.sessions.OutboundSession.encryptsrc/nio/crypto/sessions.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-commander | pip | <= 8.0.6 |