GHSA-wchh-9x6h-7f6p: olm dependency deprecation CVE-2022-39255 And CVE-2024-45193 Vulnerability

MODERATE
Share
CWE-1395
Published
Advisory Summary

GHSA-wchh-9x6h-7f6p is a MODERATE cve-2022-39255 and cve-2024-45193 vulnerability (CWE-1395: Dependency on Vulnerable Third-Party Component) affecting olm dependency deprecation libraries in the PyPI ecosystem. The issue involves cve-2022-39255 and cve-2024-45193. Remediation is available in the latest vendor maintenance releases.

GHSA-wchh-9x6h-7f6p at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-wchh-9x6h-7f6p
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-1395: Dependency on Vulnerable Third-Party Component
Affected Product olm dependency deprecation
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix GHSA-wchh-9x6h-7f6p

To remediate this vulnerability, upgrade all affected olm dependency deprecation dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

matrix-commander fixed: Latest secure release 
pip install matrix-commander>=Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show matrix-commander

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-wchh-9x6h-7f6p, inspect your installed packages using pip:

pip show matrix-commander

Analyze the terminal output to locate any version of olm dependency deprecation in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The pip show matrix-commander command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1395: Dependency on Vulnerable Third-Party Component, where the product has a dependency on a third-party component that contains one or more known vulnerabilities. In olm dependency deprecation, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers. Olm is a dependency of `matrix-commander` (Python version, not Rust version). WARNING: Due to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue. ### References - CVE-2022-39255 - CVE-2024-45193 - https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ - https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193 - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm ### Workarounds - use the Rust version: https://github.com/8go/matrix-commander-rs ### Severity: Medium CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium). CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)

GHSA-wchh-9x6h-7f6p Affected olm dependency deprecation Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
matrix-commander
pypi/matrix-commander
PyPI
≤ 8.0.6

References

GitHub Advisory / Wiki ADVISORY
https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p
olm dependency deprecation Source Repository REPOSITORY
https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979
olm dependency deprecation Source Repository REPOSITORY
https://github.com/matrix-nio/matrix-nio/pull/555
Security Fix Commit FIX COMMIT
https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626
olm dependency deprecation Source Repository REPOSITORY
https://github.com/8go/matrix-commander

Frequently Asked Questions

What is GHSA-wchh-9x6h-7f6p?
GHSA-wchh-9x6h-7f6p is a security vulnerability in olm dependency deprecation involving CVE-2022-39255 and CVE-2024-45193 under CWE-1395: Dependency on Vulnerable Third-Party Component.
Which olm dependency deprecation versions are affected?
Affected versions include releases prior to current release patches across affected packages: matrix-commander.
What version fixes GHSA-wchh-9x6h-7f6p?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is matrix-commander affected?
Yes, matrix-commander is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with GHSA-wchh-9x6h-7f6p?
GHSA-wchh-9x6h-7f6p is classified under CWE-1395: Dependency on Vulnerable Third-Party Component (The product has a dependency on a third-party component that contains one or more known vulnerabilities.).
How can I check PyPI dependencies for GHSA-wchh-9x6h-7f6p?
Run the dependency tree command: 'pip show matrix-commander'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wchh-9x6h-7f6p",
  "modified" : "2026-07-29T16:11:45Z",
  "published" : "2026-07-29T16:11:45Z",
  "aliases" : [ ],
  "summary" : "olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193",
  "details" : "### Problem\n\nMultiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.\n\nOlm is a dependency of `matrix-commander` (Python version, not Rust version).\n\nWARNING:\n\nDue to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.\n\n\n### References\n- CVE-2022-39255\n- CVE-2024-45193\n- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/\n- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193\n- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm\n\n### Workarounds\n- use the Rust version: https://github.com/8go/matrix-commander-rs \n\n### Severity:\n\nMedium\n\nCVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).\n\nCVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "matrix-commander"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "8.0.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/matrix-nio/matrix-nio/pull/555"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/8go/matrix-commander"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1395" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-29T16:11:45Z",
    "nvd_published_at" : null
  }
}