Update metrics for recent libolm CVEs - Githubissues

cisagov / vulnrichment

A repo to conduct vulnerability enrichment.

Creative Commons Zero v1.0 Universal

462 stars 35 forks source link

Update metrics for recent libolm CVEs #100

Closed davidegirardi closed 3 weeks ago

davidegirardi commented 1 month ago

🗣 Description

This PR fixes CVSS scoring for CVE-2024-45191, CVE-2024-45192 and CVE-2024-45193 which did not reflect the vulnerabilities. It also updates the SSVC section.

The changes consider libolm itself as a generic double-ratchet library, not just in the context of its use in the Matrix protocol. That would otherwise further reduce the severity.

🧪 Testing

I checked that the format is correct by running:

cat 2024/45xxx/CVE-2024-45191.json 2024/45xxx/CVE-2024-45192.json 2024/45xxx/CVE-2024-45193.json | jq

✅ Pre-approval checklist

[x] This PR has an informative and human-readable title.
[x] Changes are limited to a single goal - eschew scope creep!
[ ] All future TODOs are captured in issues, which are referenced in code comments.
[ ] All relevant type-of-change labels have been added.
[x] I have read the CONTRIBUTING document.
[ ] These code changes follow cisagov code standards.
[ ] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
[ ] Tests have been added and/or modified to cover the changes in this PR.
[ ] All new and existing tests pass.

✅ Pre-merge checklist

[ ] Revert dependencies to default branches.
[ ] Finalize version.

✅ Post-merge checklist

[ ] Create a release.

eslerm commented 1 month ago

These CVSS changes look okay to me, except Privileges Required should remain None. (i.e., joining a public channel to attempt these attacks means that the privilege is None, not Low.)

davidegirardi commented 1 month ago

I had this very discussion with a colleague while preparing the PR. My argument is that you, as the attacker, need some kind of relationship with the victim implementation to make it encrypt content you choose at will.

In the context of Matrix, public rooms are not encrypted so creating that relation would require to start a 1:1 message or join a shared private room.

That's why I think Privileges Requires is Low.

eslerm commented 1 month ago

Thanks for the explanation, that sounds reasonable.

amanion-cisa commented 1 month ago

Hi, thanks for the improvements, we'll review and make any changes upstream in the vulnrichment workflow.

jwoytek-cisa commented 3 weeks ago

@davidegirardi these entries were reevaluated and scores updated. The data was modified upstream, making it impractical to merge this PR. Thank you for the report!