CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32682 – Improper checks for deactivated users during login in synapse
https://notcve.org/view.php?id=CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. • https://github.com/matrix-org/synapse/pull/15624 https://github.com/matrix-org/synapse/pull/15634 https://github.com/matrix-org/synapse/security/advisories/GHSA-26c5-ppr8-f33p https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account https://matrix-org.github.io/synapse/latest/jwt.html https://matrix-org.github.io/synapse/latest/usage& • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39374 – Synapse Denial of service due to incorrect application of event authorization rules during state resolution
https://notcve.org/view.php?id=CVE-2022-39374
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0 Synapse es un servidor doméstico Matrix de código abierto escrito y mantenido por la Fundación Matrix.org. Si Synapse y un servidor doméstico malicioso están unidos a la misma habitación, el servidor doméstico malicioso puede engañar a Synapse para que acepte eventos previamente rechazados en su vista del estado actual de esa sala. • https://github.com/matrix-org/synapse/pull/13723 https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39335 – Synapse does not apply enough checks to servers requesting auth events of events in a room
https://notcve.org/view.php?id=CVE-2022-39335
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. • https://github.com/matrix-org/synapse/issues/13288 https://github.com/matrix-org/synapse/pull/13823 https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-32323 – Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
https://notcve.org/view.php?id=CVE-2023-32323
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. • https://github.com/matrix-org/synapse/issues/14492 https://github.com/matrix-org/synapse/pull/14642 https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41952 – Uncontrolled Resource Consumption in Matrix Synapse
https://notcve.org/view.php?id=CVE-2022-41952
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. • https://github.com/matrix-org/synapse/pull/11784 https://github.com/matrix-org/synapse/pull/11936 https://github.com/matrix-org/synapse/releases/tag/v1.52.0 https://github.com/matrix-org/synapse/releases/tag/v1.53.0 https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h • CWE-400: Uncontrolled Resource Consumption CWE-772: Missing Release of Resource after Effective Lifetime •