GHSA-wchh-9x6h-7f6p

Summary

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

Severity

medium

CWE

CWE-1395

Published

2026-07-29

Updated

2026-07-29

Advisory details

Problem

Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.

Olm is a dependency of matrix-commander (Python version, not Rust version).

WARNING:

Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.

References

• CVE-2022-39255
• CVE-2024-45193
• https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
• https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193
• https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm

Workarounds

• use the Rust version: https://github.com/8go/matrix-commander-rs

Severity:

Medium

CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).

CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)

References

• https://github.com/advisories/GHSA-wchh-9x6h-7f6p
• https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p
• https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979
• https://github.com/matrix-nio/matrix-nio/pull/555
• https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626

Related advisories

• GHSA-2464-fhr4-w9xw — critical · npm/next
• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• APPSEC-EQUIFAX-2017 — critical · Web · Apache Struts/Equifax (Apache Struts 2)
• GHSA-78g4-xqwv-q3g8 — high · PyPI/pillow
• CVE-2026-105642 — high · npm/ghost
• GHSA-wq5f-xc86-pv6w — high · npm/sharp
• GHSA-f88m-g3jw-g9cj — high · npm/sharp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity