What is GHSA-WCHH-9X6H-7F6P?

GHSA-WCHH-9X6H-7F6P is a medium-severity security vulnerability in matrix-commander (pip), affecting versions <= 8.0.6. No fixed version is listed yet.

Which versions of matrix-commander are affected by GHSA-WCHH-9X6H-7F6P?

matrix-commander (pip) versions <= 8.0.6 is affected.

Is there a fix for GHSA-WCHH-9X6H-7F6P?

No fixed version is listed for GHSA-WCHH-9X6H-7F6P yet. Monitor the advisory for updates and apply mitigations in the interim.

Is GHSA-WCHH-9X6H-7F6P exploitable, and should I be worried?

Whether GHSA-WCHH-9X6H-7F6P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-WCHH-9X6H-7F6P is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-WCHH-9X6H-7F6P in matrix-commander

Q: Which versions of matrix-commander are affected by GHSA-WCHH-9X6H-7F6P?

matrix-commander (pip) versions <= 8.0.6 is affected.

Q: Is there a fix for GHSA-WCHH-9X6H-7F6P?

No fixed version is listed for GHSA-WCHH-9X6H-7F6P yet. Monitor the advisory for updates and apply mitigations in the interim.

Q: Is GHSA-WCHH-9X6H-7F6P exploitable, and should I be worried?

Whether GHSA-WCHH-9X6H-7F6P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-WCHH-9X6H-7F6P is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Summary

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

Problem

Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.

Olm is a dependency of matrix-commander (Python version, not Rust version).

WARNING:

Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.

References

Workarounds

use the Rust version: https://github.com/8go/matrix-commander-rs

Severity:

Medium

CVE-2022-39255, MEDIUM (NVD/MITRE lists CVSS base score 5.x, treated as Medium).

CVE-2024-45193, MEDIUM (NVD shows CVSS 3.1 base score ~4.3, Medium)

Impact

Affected versions

matrix-commander (<= 8.0.6)

Security releases

Not available

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

No fixed version is listed for GHSA-WCHH-9X6H-7F6P yet.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-WCHH-9X6H-7F6P? GHSA-WCHH-9X6H-7F6P is a medium-severity security vulnerability in matrix-commander (pip), affecting versions <= 8.0.6. No fixed version is listed yet.
Which versions of matrix-commander are affected by GHSA-WCHH-9X6H-7F6P? matrix-commander (pip) versions <= 8.0.6 is affected.
Is there a fix for GHSA-WCHH-9X6H-7F6P? No fixed version is listed for GHSA-WCHH-9X6H-7F6P yet. Monitor the advisory for updates and apply mitigations in the interim.
Is GHSA-WCHH-9X6H-7F6P exploitable, and should I be worried? Whether GHSA-WCHH-9X6H-7F6P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-WCHH-9X6H-7F6P is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.