TI-2024-22521 Aliases CVE-2024-34063 GHSA-c3hm-hxwf-g5c6

Degraded secret zeroization capabilities in vodozemac

LOW 12CWE-1188Published 2024-05-03 · Updated 2024-08-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00135 3rd percentileScored 2026-11-08

Fix Fixed vodozemac (matrix-org): 0.6.0vodozemac (crates.io): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	vodozemac	0.5.0 to before 0.6.0	0.6.0	Patch available	CNA
—	vodozemac (crates.io)	0.5.0 to before 0.6.0	0.6.0	Patch available	GHSA-c3hm-hxwf-g5c6

vodozemac Vendormatrix-org Affected 0.5.0 to before 0.6.0 Fixed in 0.6.0 Patch available CNA
vodozemac (crates.io) Vendor— Affected 0.5.0 to before 0.6.0 Fixed in 0.6.0 Patch available GHSA-c3hm-hxwf-g5c6

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix-org:vodozemac::::::::	—	—	—

cpe:2.3:a:matrix-org:vodozemac:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA vodozemac (matrix-org) Fixed in 0.6.0
Fix · GHSA-c3hm-hxwf-g5c6 vodozemac (crates.io) Fixed in 0.6.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-34063
2026-10-03 Alias added: GHSA-c3hm-hxwf-g5c6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-34063

Other 4

TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8

See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences