DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-WCHH-9X6H-7F6P: GHSA-WCHH-9X6H-7F6P: Cryptographic Vulnerabilities and Deprecation of Olm in matrix-commander

#security #cve #cybersecurity #ghsa

GHSA-WCHH-9X6H-7F6P: Cryptographic Vulnerabilities and Deprecation of Olm in matrix-commander

Vulnerability ID: GHSA-WCHH-9X6H-7F6P
CVSS Score: 5.9
Published: 2026-07-29

GHSA-WCHH-9X6H-7F6P documents the critical deprecation of the cryptographic library libolm (Olm) and its Python binding wrapper python-olm, which matrix-commander depended upon via its downstream client library matrix-nio. Multiple cryptographic vulnerabilities (timing leaks, side-channels, signature malleability, and protocol confusion) were disclosed in 2022 and 2024. Because libolm is unmaintained, Python clients using matrix-commander are considered cryptographically unsafe until migrating to vodozemac.

TL;DR

The matrix-commander CLI tool is cryptographically unsafe due to legacy dependencies on the deprecated libolm library, which contains timing side-channels and protocol confusion vulnerabilities. Users must migrate to the Rust alternative or upgrade downstream dependencies to use vodozemac.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
  • Attack Vector: Network / Local Side-Channel / Compromised Homeserver
  • CVSS: 5.9 (Medium) / 4.3 (Medium)
  • EPSS: N/A (Deprecation Advisory)
  • Impact: Information Disclosure / Message Redirection / Build Failures
  • Exploit Status: No active public weaponized exploits (Theoretical PoC)
  • KEV Status: Not Listed

Affected Systems

  • matrix-commander (Python PyPI package)
  • matrix-nio (Python downstream library)
  • python-olm (Python bindings)
  • libolm (C cryptographic engine)
  • matrix-commander: <= 8.0.6 (Fixed in: Migration to matrix-commander-rs)

Code Analysis

Commit: 71a1c80

Replace python-olm with vodozemac

Exploit Details

  • soatok.blog: Comprehensive security analysis detailing the timing leaks, signature malleability, and legacy implementation flaws in libolm.

Mitigation Strategies

  • Migrate python-based matrix-commander installations to the compiled Rust alternative (matrix-commander-rs).
  • Manually upgrade downstream matrix-nio dependencies to version using Rust-backed vodozemac instead of unmaintained libolm.
  • Isolate Python execution environments within virtual containers to reduce the threat of hardware cache timing side-channels.

Remediation Steps:

  1. Navigate to https://github.com/8go/matrix-commander-rs
  2. Follow the Rust installation guide to compile and deploy the memory-safe CLI client binary.
  3. For legacy Python environments, update matrix-nio to point to the master branch or stable version incorporating PR #555.
  4. Run pip install -U matrix-nio[e2e] to fetch vodozemac dependency and verify built structures compile successfully without CMake errors.

References

Read the full report for GHSA-WCHH-9X6H-7F6P on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)