[24.05] olm: mark as vulnerable #335189
Merged
[24.05] olm: mark as vulnerable #335189
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
See <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/>. (cherry picked from commit e4767b4)
These vendor the libolm code. (cherry picked from commit bbfd5d1)
emilazy
force-pushed
the
push-zrsuyznoqtmp
branch
from
a621af4
to
56e4b26
Compare
This was referenced Aug 23, 2024
CVE numbers were assigned, and This Week in Matrix included an announcement from the Matrix.org project lead. An official post from the Matrix.org Foundation is apparently still pending. (cherry picked from commit 069f7de)
Additional information has been published by upstream about why they believe the vulnerability to not be exploitable over the network: https://matrix.org/blog/2024/08/libolm-deprecation/ This commit * updates the text of the vulnerability warning to indicate that upstream does not believe the issues to be exploitable over the network, and * adds a link to the blog post. Co-authored-by: Emily <hello@emily.moe> Signed-off-by: Sumner Evans <sumner.evans@automattic.com> (cherry picked from commit 537d3c4)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
Manual backport of #334638.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.