GHSA-wchh-9x6h-7f6p
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
GHSA-wchh-9x6h-7f6p is a vulnerability with no CVSS score yet in matrix-commander, published July 29, 2026. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Problem
Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.
Olm is a dependency of matrix-commander (Python version, not Rust version).
WARNING:
Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.
References
- CVE-2022-39255
- CVE-2024-45193
- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193
- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm
Workarounds
- use the Rust version: https://github.com/8go/matrix-commander-rs
Severity:
Medium
CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).
CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-commanderPyPI | through 8.0.6 | None known |
matrix-commanderPyPI | through 8.0.6, plus listed versions 2.16.02.17.02.18.02.19.02.20.0 Show 45 moreShow less2.21.02.23.02.24.02.27.02.28.02.29.02.30.02.31.02.32.02.34.02.34.12.35.02.36.02.37.02.38.03.0.03.1.03.2.03.3.03.4.03.5.03.5.193.5.243.5.253.5.263.5.274.0.05.0.05.1.05.2.06.0.06.0.16.0.27.0.07.1.07.2.07.3.07.3.17.4.07.5.07.6.07.6.17.6.27.6.37.7.0 | None known |
What each source reports
GitHub AdvisoriesNo score
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
Problem
Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.
Olm is a dependency of matrix-commander (Python version, not Rust version).
WARNING:
Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.
References
- CVE-2022-39255
- CVE-2024-45193
- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193
- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm
Workarounds
- use the Rust version: https://github.com/8go/matrix-commander-rs
Severity:
Medium
CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).
CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)
- Record
GHSA-wchh-9x6h-7f6p- Weakness
- CWE-1395
- Updated
- 2026-11-02
OSVNo score
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
Problem
Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.
Olm is a dependency of matrix-commander (Python version, not Rust version).
WARNING:
Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.
References
- CVE-2022-39255
- CVE-2024-45193
- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193
- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm
Workarounds
- use the Rust version: https://github.com/8go/matrix-commander-rs
Severity:
Medium
CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).
CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)
- Record
GHSA-wchh-9x6h-7f6p- Weakness
- CWE-1395
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p
Left out here: 5 versions. The JSON record has them.