{"uuid": "80ec897a-cf8c-4dde-9744-f34bfce02069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hw6g-j8v6-9hcm", "type": "seen", "source": "https://gist.github.com/alon710/d12f2b2b8a8eb557d027885a6580665a", "content": "# GHSA-WCHH-9X6H-7F6P: GHSA-WCHH-9X6H-7F6P: Cryptographic Vulnerabilities and Deprecation of Olm in matrix-commander\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/GHSA-WCHH-9X6H-7F6P\n\n## Summary\nGHSA-WCHH-9X6H-7F6P documents the critical deprecation of the cryptographic library libolm (Olm) and its Python binding wrapper python-olm, which matrix-commander depended upon via its downstream client library matrix-nio. Multiple cryptographic vulnerabilities (timing leaks, side-channels, signature malleability, and protocol confusion) were disclosed in 2022 and 2024. Because libolm is unmaintained, Python clients using matrix-commander are considered cryptographically unsafe until migrating to vodozemac.\n\n## TL;DR\nThe matrix-commander CLI tool is cryptographically unsafe due to legacy dependencies on the deprecated libolm library, which contains timing side-channels and protocol confusion vulnerabilities. Users must migrate to the Rust alternative or upgrade downstream dependencies to use vodozemac.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)\n- **Attack Vector**: Network / Local Side-Channel / Compromised Homeserver\n- **CVSS**: 5.9 (Medium) / 4.3 (Medium)\n- **EPSS**: N/A (Deprecation Advisory)\n- **Impact**: Information Disclosure / Message Redirection / Build Failures\n- **Exploit Status**: No active public weaponized exploits (Theoretical PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- matrix-commander (Python PyPI package)\n- matrix-nio (Python downstream library)\n- python-olm (Python bindings)\n- libolm (C cryptographic engine)\n- **matrix-commander**: <= 8.0.6 (Fixed in: `Migration to matrix-commander-rs`)\n\n## Mitigation\n\n- Migrate python-based matrix-commander installations to the compiled Rust alternative (matrix-commander-rs).\n- Manually upgrade downstream matrix-nio dependencies to version using Rust-backed vodozemac instead of unmaintained libolm.\n- Isolate Python execution environments within virtual containers to reduce the threat of hardware cache timing side-channels.\n\n**Remediation Steps:**\n1. Navigate to https://github.com/8go/matrix-commander-rs\n2. Follow the Rust installation guide to compile and deploy the memory-safe CLI client binary.\n3. For legacy Python environments, update matrix-nio to point to the master branch or stable version incorporating PR #555.\n4. Run pip install -U matrix-nio[e2e] to fetch vodozemac dependency and verify built structures compile successfully without CMake errors.\n\n## References\n\n- [Primary Security Advisory](https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p)\n- [PyPI Deprecation Issue Discussion](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979)\n- [Issue #204 CMake Compilation Error](https://github.com/8go/matrix-commander/issues/204)\n- [Replacement Pull Request (PR #555)](https://github.com/matrix-nio/matrix-nio/pull/555)\n- [Migration Fix Commit (Commit 71a1c80)](https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626)\n- [Olm Security Analysis Blog Post](https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/)\n- [Downstream iOS Advisory](https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm)\n- [Matrix Commander Repository](https://github.com/8go/matrix-commander)\n- [Rust Version Alternative](https://github.com/8go/matrix-commander-rs)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WCHH-9X6H-7F6P) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T08:32:07.454824Z"}