CVE-2024-34063 json
Degraded secret zeroization capabilities in vodozemac
published 2y ago modified 30d ago also GHSA-c3hm-hxwf-g5c6 , RUSTSEC-2024-0342 , EUVD-2024-1567
- cvss
- 2.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- crates.io vodozemac 0.6.0
- cargo-audit-advisory-db openSUSE Tumbleweed 20240528-1.1
opensuse advisories openSUSE-SU-2024:14009-1
Is CVE-2024-34063 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | vodozemac | >=0.5.0, <0.6.0 |
0.6.0 |
Affected products
- matrix-org vodozemac
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
github.com
/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9
web
-
github.com
/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-g5c6
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-34063
advisory
-
github.com
/matrix-org/vodozemac
package
-
rustsec.org
/advisories/RUSTSEC-2024-0342.html
web, advisory
-
crates.io
/crates/vodozemac
package
Sources
- CVE List CVE-2024-34063
- GitHub Advisory GHSA-c3hm-hxwf-g5c6
- NVD CVE-2024-34063
- OSV RUSTSEC-2024-0342
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.