CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2022-39335

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

Matrix Synapse 信息泄露漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability exists in Matrix Synapse that stems from the Synapse master server answering authorization event queries not adequately checking whether the requesting server should be able ...

Matrix 资源管理错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. Matrix Synapse suffers from a security vulnerability that stems from the fact that if both Synapse and a malicious home server join the same room, the malicious home server can trick Synapse into...

CVE-2022-39374

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

Matrix Synapse 输入验证错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability exists in Matrix Synapse that originates from the fact that a malicious user on Synapse master server X who is authorized to create certain state events can disable outbound...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

matrix-server-isenguard (>=0.1.1 <=0.2.0), matrix-synapse-testutils (>=1.65.0.0 <=1.73.0.1) +7 more potentially affected by CVE-2023-32323 via matrix-synapse (>=0.33.9 <=1.73.0)

matrix-synapse PYPI version =0.33.9, =0.1.1, =1.65.0.0, =0.1.2, =0.100.2, =0.1.0, =0.1.0, =0.8.0, =0.8.4 Source cves: CVE-2023-32323 Source advisory: OSV:GHSA-F3WC-3VXV-XMVR...

GHSA-F3WC-3VXV-XMVR Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Impact A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. Details The Matrix protocol allows homeservers to provide an...

matrix-synapse-testutils (>=1.65.0.0 <=1.68.0.0) potentially affected by CVE-2022-39374 via matrix-synapse (>=1.65.0 <=1.68.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.68.0.0 Source cves: CVE-2022-39374 Source advisory: OSV:GHSA-P9QP-C452-F9R7...

matrix-server-isenguard (>=0.1.1 <=0.2.0), matrix-synapse-testutils (>=1.65.0.0 <=1.68.0.0) +7 more potentially affected by CVE-2022-39335 via matrix-synapse (>=0.33.9 <=1.68.0)

matrix-synapse PYPI version =0.33.9, =0.1.1, =1.65.0.0, =0.1.2, =0.100.2, =0.1.0, =0.1.0, =0.8.0, =0.8.4 Source cves: CVE-2022-39335 Source advisory: OSV:GHSA-45CJ-F97F-GGWV...

GHSA-45CJ-F97F-GGWV Synapse does not apply enough checks to servers requesting auth events of events in a room

Impact Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorisation events of events in a room. This is necessary so that a homeserver receiving some events can validate that those...

PT-2023-13719 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions up to and including 1.68.0 Description: The Matrix Federation API in Synapse allows remote homeservers to request authorization events in a room, which is necessary for validating the legitimacy and permission of events...

Ubuntu: Security Advisory (USN-6076-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6076-1 matrix-synapse vulnerabilities

It was discovered that Synapse incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. CVE-2019-18835, CVE-2018-12291, CVE-2018-10657 It was...

HTML Injection

matrix-react-sdk is vulnerable to HTML Injection. The vulnerability exists in the bodyToHtml function of HtmlUtils.tsx because it does not escape the plainBody parameter of the highlighter attribute, which allows an attacker to inject and execute malicious plaintext messages with HTML payloads...

RLSA-2023:1809 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0. Security Fixes: Thunderbird: Revocation status of S/Mime recipient certificates was not checked CVE-2023-0547 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to...