VulnerabilityAnalyzed

CVE-2024-45193

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

MEDIUM 4.3EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-327
Affected: matrix/olm
Source: cve@mitre.org

References

https://gitlab.matrix.org/matrix-org/olm/Product
https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985Patch
https://news.ycombinator.com/item?id=41249371Issue Tracking
https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.