Bug 2302585

Summary:	CVE-2024-40648: matrix-sdk-crypto: UserIdentity::is_verified not checking verification status of own user identity while performing the check
Product:	[Fedora] Fedora	Reporter:	Fabio Valentini <decathorpe>
Component:	fractal	Assignee:	Pete Walter <walter.pete>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	walter.pete
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	fractal-8-1.fc41 fractal-8-1.fc40	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-09-19 00:16:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Fabio Valentini 2024-08-03 11:11:43 UTC

The version of the matrix-sdk-crypto crate that is vendored in the fractal package is vulnerable:

https://rustsec.org/advisories/RUSTSEC-2024-0356.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40648
https://github.com/advisories/GHSA-4qg4-cvh2-crgg

Version bundled in fractal: 0.7.0
Version with the fix:       0.7.2

Additionally, I had to download the vendor tarball and check the contents manually because the package does not correctly specify bundled dependencies in RPM metadata. I suggest using the machinery around %cargo_vendor_manifest to automate this process and keep the list of vendored Rust crates accurate.

Comment 1 Fedora Update System 2024-09-10 08:12:20 UTC

FEDORA-2024-e826214a67 (fractal-8-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-e826214a67

Comment 2 Fedora Update System 2024-09-10 08:12:25 UTC

FEDORA-FLATPAK-2024-275ff7fa00 (fractal-flatpak-8-1) has been submitted as an update to Fedora 40 Flatpaks.
https://bodhi.fedoraproject.org/updates/FEDORA-FLATPAK-2024-275ff7fa00

Comment 3 Fedora Update System 2024-09-10 08:12:30 UTC

FEDORA-2024-fb85a33c7e (fractal-8-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-fb85a33c7e

Comment 4 Fedora Update System 2024-09-11 02:28:05 UTC

FEDORA-2024-fb85a33c7e has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-fb85a33c7e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-fb85a33c7e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2024-09-11 02:57:11 UTC

FEDORA-2024-e826214a67 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-e826214a67`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-e826214a67

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2024-09-11 02:59:07 UTC

FEDORA-FLATPAK-2024-275ff7fa00 has been pushed to the Fedora 40 Flatpaks testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-FLATPAK-2024-275ff7fa00

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-09-19 00:16:40 UTC

FEDORA-2024-fb85a33c7e (fractal-8-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2024-09-19 02:30:42 UTC

FEDORA-2024-e826214a67 (fractal-8-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2024-09-19 03:13:27 UTC

FEDORA-FLATPAK-2024-275ff7fa00 (fractal-flatpak-8-1) has been pushed to the Fedora 40 Flatpaks stable repository.
If problem still persists, please make note of it in this bug report.