Deps.rs

matrix-sdk-indexeddb 0.2.0

[![dependency status](https://deps.rs/crate/matrix-sdk-indexeddb/0.2.0/status.svg)](https://deps.rs/crate/matrix-sdk-indexeddb/0.2.0)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate matrix-sdk-indexeddb

Dependencies

(19 total, 10 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.0.571.0.98up to date
 async-trait^0.1.530.1.88up to date
 base64^0.13.00.22.1out of date
 dashmap^5.2.06.1.0out of date
 derive_builder^0.11.20.20.2out of date
 futures-util^0.3.210.3.31up to date
 getrandom^0.2.60.3.2out of date
 indexed_db_futures^0.2.30.6.3out of date
 js-sys^0.3.580.3.77up to date
 matrix-sdk-base^0.6.00.11.0out of date
 matrix-sdk-crypto ⚠️^0.6.00.11.0out of date
 matrix-sdk-store-encryption^0.2.00.11.0out of date
 ruma^0.7.00.12.2out of date
 serde^1.0.1361.0.219up to date
 serde_json^1.0.791.0.140up to date
 thiserror^1.0.302.0.12out of date
 tracing^0.1.340.1.41up to date
 wasm-bindgen^0.2.800.2.100up to date
 web-sys^0.3.570.3.77up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 uuid^1.0.01.16.0up to date
 wasm-bindgen-test^0.3.300.3.50up to date

Security Vulnerabilities

matrix-sdk-crypto: `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

RUSTSEC-2024-0356

The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.

Impact

If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate.