{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-commander"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T16:11:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Problem\n\nMultiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side\u2011channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 \u201cOlm/Megolm protocol confusion\u201d advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.\n\nOlm is a dependency of `matrix-commander` (Python version, not Rust version).\n\nWARNING:\n\nDue to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.\n\n\n### References\n- CVE-2022-39255\n- CVE-2024-45193\n- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/\n- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193\n- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm\n\n### Workarounds\n- use the Rust version: https://github.com/8go/matrix-commander-rs \n\n### Severity:\n\nMedium\n\nCVE-2022-39255 \u2014 MEDIUM (NVD/MITRE lists CVSS base score 5.x \u2014 treated as Medium).\n\nCVE-2024-45193 \u2014 MEDIUM (NVD shows CVSS 3.1 base score ~4.3 \u2014 Medium)",
  "id": "GHSA-wchh-9x6h-7f6p",
  "modified": "2026-07-29T16:11:45Z",
  "published": "2026-07-29T16:11:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-nio/matrix-nio/pull/555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/8go/matrix-commander"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193"
}