Bug 2302585 - CVE-2024-40648: matrix-sdk-crypto: UserIdentity::is_verified not checking verification status of own user identity while performing the check
Summary: CVE-2024-40648: matrix-sdk-crypto: UserIdentity::is_verified not checking ver...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: fractal
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Pete Walter
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-08-03 11:11 UTC by Fabio Valentini
Modified: 2024-09-19 03:13 UTC (History)
1 user (show)

Fixed In Version: fractal-8-1.fc41 fractal-8-1.fc40
Clone Of:
Environment:
Last Closed: 2024-09-19 00:16:40 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Fabio Valentini 2024-08-03 11:11:43 UTC
The version of the matrix-sdk-crypto crate that is vendored in the fractal package is vulnerable:

https://rustsec.org/advisories/RUSTSEC-2024-0356.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40648
https://github.com/advisories/GHSA-4qg4-cvh2-crgg

Version bundled in fractal: 0.7.0
Version with the fix:       0.7.2

Additionally, I had to download the vendor tarball and check the contents manually because the package does not correctly specify bundled dependencies in RPM metadata. I suggest using the machinery around %cargo_vendor_manifest to automate this process and keep the list of vendored Rust crates accurate.

Comment 1 Fedora Update System 2024-09-10 08:12:20 UTC
FEDORA-2024-e826214a67 (fractal-8-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-e826214a67

Comment 2 Fedora Update System 2024-09-10 08:12:25 UTC
FEDORA-FLATPAK-2024-275ff7fa00 (fractal-flatpak-8-1) has been submitted as an update to Fedora 40 Flatpaks.
https://bodhi.fedoraproject.org/updates/FEDORA-FLATPAK-2024-275ff7fa00

Comment 3 Fedora Update System 2024-09-10 08:12:30 UTC
FEDORA-2024-fb85a33c7e (fractal-8-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-fb85a33c7e

Comment 4 Fedora Update System 2024-09-11 02:28:05 UTC
FEDORA-2024-fb85a33c7e has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-fb85a33c7e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-fb85a33c7e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2024-09-11 02:57:11 UTC
FEDORA-2024-e826214a67 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-e826214a67`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-e826214a67

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2024-09-11 02:59:07 UTC
FEDORA-FLATPAK-2024-275ff7fa00 has been pushed to the Fedora 40 Flatpaks testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-FLATPAK-2024-275ff7fa00

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-09-19 00:16:40 UTC
FEDORA-2024-fb85a33c7e (fractal-8-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2024-09-19 02:30:42 UTC
FEDORA-2024-e826214a67 (fractal-8-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2024-09-19 03:13:27 UTC
FEDORA-FLATPAK-2024-275ff7fa00 (fractal-flatpak-8-1) has been pushed to the Fedora 40 Flatpaks stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.