{"id":"CVE-2024-52813","aliases":["RUSTSEC-2024-0434","GHSA-r5vf-wf4h-82gg"],"title":" Missing facility to signal rotation of a verified cryptographic identity","summary":" Missing facility to signal rotation of a verified cryptographic identity","severity":"none","vendor":"matrix-sdk-crypto","product":"matrix-sdk-crypto","ecosystem":"rust","affected":["matrix-sdk-crypto >= 0.0.0-0, < 0.8.0"],"patched":["matrix-sdk-crypto 0.8.0"],"published":"2024-01-07","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:07.418421276Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0434","references":[{"url":"https://crates.io/crates/matrix-sdk-crypto"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0434.html"},{"url":"https://github.com/matrix-org/matrix-rust-sdk/pull/3795"}],"tags":["osv","rust"],"epss":0.00477,"epssPercentile":0.39361,"ingestedAt":"2026-10-13T11:45:30.173Z","slug":"CVE-2024-52813","body":"## Overview\n\nVersions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated\nmechanism to notify that a user's cryptographic identity has changed from a\nverified to an unverified one, which could cause client applications relying on\nthe SDK to overlook such changes.\n\nmatrix-sdk-crypto 0.8.0 adds a new `VerificationLevel::VerificationViolation`\nenum variant which indicates that a previously verified identity has been\nchanged.\n\n## Affected packages\n\n- `matrix-sdk-crypto >= 0.0.0-0, < 0.8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-sdk-crypto 0.8.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}