Bug 1223882

Summary: VUL-0: CVE-2024-34063: fractal: vodozemac: degraded secret zeroization capabilities
Product: [openSUSE] openSUSE Tumbleweed Reporter: Carlos López <carlos.lopez>
Component: SecurityAssignee: openSUSE GNOME <os.gnome.maintainers>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: carlos.lopez, security-team, smash_bz
Version: Current   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/404259/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1223881    

Description Carlos López 2024-05-03 16:10:22 UTC 
+++ This bug was initially created as a clone of Bug #1223881 +++

vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34063
https://www.cve.org/CVERecord?id=CVE-2024-34063
https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9
https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-g5c6
Comment 1 Carlos López 2024-05-03 16:11:12 UTC 
fractal embeds vodozemac v0.5.1