Executive brief
The Python version of matrix-commander relies on a deprecated cryptographic library called libolm, which contains several known security flaws. These flaws could allow attackers to potentially intercept or tamper with encrypted messages by exploiting weaknesses in how the software handles encryption keys and data decoding. Because the underlying library is no longer being updated to fix these issues, the software is considered cryptographically unsafe for secure communications.
Technical details
The Python implementation of matrix-commander depends on libolm via matrix-nio. libolm is affected by several vulnerabilities including CVE-2024-45193 (AES timing/side-channel leaks and base64 decoding timing leaks) and CVE-2022-39255 (Olm/Megolm protocol confusion). These issues allow for potential side-channel attacks and cryptographic malleability. The maintainers have declared the Python version unsafe because libolm is deprecated and unpatched against these flaws. A fix requires migrating the underlying matrix-nio dependency to use the vodozemac library, which was addressed in matrix-nio PR #555. Users are advised to migrate to the Rust-based version of matrix-commander.
Affected products
- 8go matrix-commander <= 8.0.6
Timeline
- 2022-09-23: disclosed: CVE-2022-39255 disclosed
- 2024-08-14: disclosed: CVE-2024-45193 and other Olm vulnerabilities disclosed
- 2026-06-08: advisory: Initial advisory published by 8go
- 2026-07-23: patched: Dependency matrix-nio merged fix to replace libolm with vodozemac
- 2026-07-29: advisory: GitHub reviewed advisory published
References
- https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p
- https://github.com/8go/matrix-commander/issues/204
- https://github.com/matrix-nio/matrix-nio/pull/555
- https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626
- https://api.github.com/repos/8go/matrix-commander/security-advisories/GHSA-wchh-9x6h-7f6p