CVE-2024-34353— matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Quick assessment
Affected
matrix-org matrix-sdk-crypto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix 0.7.1之前版本存在日志信息泄露漏洞，该漏洞源于用户设备之间密钥共享，并在所有设备丢失时提供冗余副本。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-34353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Source: CVE Program / CVE List V5
Vulnerability Description
The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric
cryptography, with each server-side key backup assigned a unique public-private key pair. Due to a logic bug introduced in commit 71136e44c03c79f80d6d1a2446673bc4d53a2067, matrix-sdk-crypto version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate). This issue has been resolved in matrix-sdk-crypto version 0.7.1. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Matrix 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix 0.7.1之前版本存在日志信息泄露漏洞，该漏洞源于用户设备之间密钥共享，并在所有设备丢失时提供冗余副本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| matrix-org | matrix-sdk-crypto | = 0.7.0 | - |
|
II. Public POCs for CVE-2024-34353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-34353
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-34353 (2)
Vendor Advisories for CVE-2024-34353 (1)
Other References for CVE-2024-34353 (2)
-
https://crates.io/crates/matrix-sdk-crypto/0.7.1 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: matrix-org
-
CVE-2026-45056
Matrix Rust SDK: Sender-binding gaps in to-device and room-k -
CVE-2026-45057
matrix-sdk-ui: Incomplete edit validation -
CVE-2026-63097
Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State E -
CVE-2026-63096
Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Downlo -
CVE-2026-63095
Dendrite 0.13.8 Improper Authorization via POST account/3pid
Same weakness: CWE-532
-
CVE-2026-92872
Pgpool-II敏感信息泄露至日志文件漏洞 -
CVE-2026-81862
Apache Airflow Teradata provider: Teradata transfer operator -
CVE-2025-71425
Contrast before 1.8.1 Information Disclosure via Logging -
CVE-2025-71423
Edgelesssys Contrast before 1.12.2 Workload Secrets Informat -
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem
V. Comments for CVE-2024-34353
No comments yet