Bug 951441 (CVE-2024-45191, CVE-2024-45192, CVE-2024-45193)

Summary:	dev-libs/olm: multiple vulenrabilities
Product:	Gentoo Security	Reporter:	Petr Vaněk <arkamar>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	gavin, proxy-maint
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=951438
Whiteboard:	B3 [?]
Package list:		Runtime testing required:	---

Description Petr Vaněk gentoo-dev

2025-03-15 21:58:22 UTC

CVE-2024-45191 - AES implementation is vulnerable to cache-timing attacks
CVE-2024-45192 - Timing leakage in base64 decoding of private key material
CVE-2024-45193 - Ed25519 signatures are malleable

Comment 1 Petr Vaněk gentoo-dev

2025-03-15 22:06:43 UTC

Upstream is deprecated [1]. The package has two rev-deps in ::gentoo tree currently.

[1] https://gitlab.matrix.org/matrix-org/olm#important-libolm-is-now-deprecated