{"id":"RUSTSEC-2024-0356","revision":"93cb2cfddee84b81ae4ea988a093c555","records":[{"revision":"93cb2cfddee84b81ae4ea988a093c555","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0356","aliases":["CVE-2024-40648","GHSA-4qg4-cvh2-crgg"],"title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check","description":"The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before\nversion 0.7.2 doesn't take into account the verification status of the user's\nown identity while performing the check and may as a result return a value\ncontrary to what is implied by its name and documentation.\n\n## Impact\n\nIf the method is used to decide whether to perform sensitive operations towards\na user identity, a malicious homeserver could manipulate the outcome in order to\nmake the identity appear trusted. This is not a typical usage of the method,\nwhich lowers the impact. The method itself is not used inside the\nmatrix-sdk-crypto crate.","state":0,"publishedAt":"2024-07-18T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:12.4056857+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.7.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/matrix-sdk-crypto","https://rustsec.org/advisories/RUSTSEC-2024-0356.html","https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0356","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0356","identifiers":["RUSTSEC-2024-0356","CVE-2024-40648","GHSA-4qg4-cvh2-crgg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}