Vulnerabilities in pkg:pypi/matrix-commander
PACKAGEGHSA-wchh-9x6h-7f6p is a MODERATE cve-2022-39255 and cve-2024-45193 vulnerability (CWE-1395: Dependency on Vulnerable Third-Party Component) affecting olm dependency deprecation libraries in the PyPI ecosystem. The issue involves cve-2022-39255 and cve-2024-45193. Remediation is available in the latest vendor maintenance releases.
pkg:pypi/matrix-commander
Vulnerability advisories affecting package pkg:pypi/matrix-commander. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-wchh-9x6h-7f6p | - | MODERATE | olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193 |
GHSA-wchh-9x6h-7f6p at a Glance
How to Fix GHSA-wchh-9x6h-7f6p
To remediate this vulnerability, upgrade all affected olm dependency deprecation dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install matrix-commander>=Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show matrix-commanderHow to Check if You Are Affected
To determine whether your Python environment is affected by GHSA-wchh-9x6h-7f6p, inspect your installed packages using pip:
pip show matrix-commanderAnalyze the terminal output to locate any version of olm dependency deprecation in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The pip show matrix-commander command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1395: Dependency on Vulnerable Third-Party Component, where the product has a dependency on a third-party component that contains one or more known vulnerabilities. In olm dependency deprecation, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-wchh-9x6h-7f6p Affected olm dependency deprecation Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
matrix-commander
|
PyPI |
≤ 8.0.6
|
|
References
Frequently Asked Questions
What is GHSA-wchh-9x6h-7f6p?
Which olm dependency deprecation versions are affected?
What version fixes GHSA-wchh-9x6h-7f6p?
Is matrix-commander affected?
What CWE is associated with GHSA-wchh-9x6h-7f6p?
How can I check PyPI dependencies for GHSA-wchh-9x6h-7f6p?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wchh-9x6h-7f6p",
"modified" : "2026-07-29T16:11:45Z",
"published" : "2026-07-29T16:11:45Z",
"aliases" : [ ],
"summary" : "olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193",
"details" : "### Problem\n\nMultiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.\n\nOlm is a dependency of `matrix-commander` (Python version, not Rust version).\n\nWARNING:\n\nDue to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.\n\n\n### References\n- CVE-2022-39255\n- CVE-2024-45193\n- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/\n- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193\n- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm\n\n### Workarounds\n- use the Rust version: https://github.com/8go/matrix-commander-rs \n\n### Severity:\n\nMedium\n\nCVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).\n\nCVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "matrix-commander"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "8.0.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p"
}, {
"type" : "WEB",
"url" : "https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979"
}, {
"type" : "WEB",
"url" : "https://github.com/matrix-nio/matrix-nio/pull/555"
}, {
"type" : "WEB",
"url" : "https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/8go/matrix-commander"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1395" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-29T16:11:45Z",
"nvd_published_at" : null
}
}