https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 06:33:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-5473 EUVD-2026-5473 https://cve.radiocsirt.org/vuln/euvd-2026-5473 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34353 <p>The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharing between a user&#39;s devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair. Due to a logic bug introduced in commit 71136e44c03c79f80d6d1a2446673bc4d53a2067, matrix-sdk-crypto version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate). This issue has been resolved in matrix-sdk-crypto version 0.7.1. No known workarounds are available.</p> <p>The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharing between a user&#39;s devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair. Due to a logic bug introduced in commit 71136e44c03c79f80d6d1a2446673bc4d53a2067, matrix-sdk-crypto version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate). This issue has been resolved in matrix-sdk-crypto version 0.7.1. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-34353 https://cve.radiocsirt.org/vuln/ghsa-9ggc-845v-gcgv <p><strong>Affected:</strong> crates.io: matrix-sdk-crypto</p> <p>### Introduction</p> <p>In Matrix, the server-side *key backup* stores encrypted copies of Matrix message keys. This facilitates key sharing between a user&#39;s devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair.</p> <p>### Impact</p> <p>Due to a logic bug introduced in https://github.com/matrix-org/matrix-rust-sdk/pull/2961/commits/71136e44c03c79f80d6d1a2446673bc4d53a2067, the matrix-sdk-crypto crate version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate).</p> <p>### Patches This issue has been resolved in matrix-sdk-crypto [version 0.7.1](https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-crypto-0.7.1).</p> <p>### Workarounds None.</p> <p>### References</p> <p>- [crates.io release](https://crates.io/crates/matrix-sdk-crypto/0.7.1)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).</p> <p><strong>Affected:</strong> crates.io: matrix-sdk-crypto</p> <p>### Introduction</p> <p>In Matrix, the server-side *key backup* stores encrypted copies of Matrix message keys. This facilitates key sharing between a user&#39;s devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair.</p> <p>### Impact</p> <p>Due to a logic bug introduced in https://github.com/matrix-org/matrix-rust-sdk/pull/2961/commits/71136e44c03c79f80d6d1a2446673bc4d53a2067, the matrix-sdk-crypto crate version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate).</p> <p>### Patches This issue has been resolved in matrix-sdk-crypto [version 0.7.1](https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-crypto-0.7.1).</p> <p>### Workarounds None.</p> <p>### References</p> <p>- [crates.io release](https://crates.io/crates/matrix-sdk-crypto/0.7.1)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).</p> https://cve.radiocsirt.org/vuln/ghsa-9ggc-845v-gcgv