CVE-2024-45192

EUVD-2024-41368
An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Affected Products (NVD)
VendorProductVersion
matrixolm
𝑥
≤ 3.2.16
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
olm
bookworm
ignored
bullseye
ignored
forky
vulnerable
sid
vulnerable
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
olm
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
Common Weakness Enumeration
References
https://gitlab.matrix.org/matrix-org/olm/
https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985
https://news.ycombinator.com/item?id=41249371
https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/