Deps.rs

matrix-sdk-base 0.6.1

[![dependency status](https://deps.rs/crate/matrix-sdk-base/0.6.1/status.svg)](https://deps.rs/crate/matrix-sdk-base/0.6.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate matrix-sdk-base

Dependencies

(18 total, 7 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-stream^0.3.30.3.6up to date
 async-trait^0.1.530.1.92up to date
 dashmap^5.2.06.2.1out of date
 futures-channel^0.3.210.3.34up to date
 futures-core^0.3.210.3.34up to date
 futures-signals^0.3.300.3.34up to date
 futures-util^0.3.210.3.34up to date
 http^0.2.61.5.0out of date
 lru^0.8.00.18.5out of date
 matrix-sdk-common^0.6.00.19.1out of date
 matrix-sdk-crypto ⚠️^0.6.00.19.1insecure
 once_cell^1.10.01.21.4up to date
 ruma^0.7.00.17.0out of date
 serde^1.0.1361.0.229up to date
 serde_json^1.0.791.0.151up to date
 thiserror^1.0.302.0.21out of date
 tracing^0.1.340.1.44up to date
 zeroize^1.3.01.9.0up to date

Dev dependencies

(8 total, 3 outdated)

CrateRequiredLatestStatus
 assign^1.1.11.1.1up to date
 env_logger^0.9.00.11.11out of date
 futures^0.3.210.3.34up to date
 http^0.2.61.5.0out of date
 matrix-sdk-test^0.6.00.19.1out of date
 tokio^1.17.01.53.2up to date
 tracing^0.1.260.1.44up to date
 wasm-bindgen-test^0.3.300.3.79up to date

Security Vulnerabilities

matrix-sdk-crypto: `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

RUSTSEC-2024-0356

The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.

Impact

If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate.