PYSEC-2023-65

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

Code injection

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

Code injection

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

matrix-synapse-testutils (>=1.65.0.0, <=1.73.0.1) potentially affected by CVE-2023-32323 via matrix-synapse (>=1.65.0, <=1.73.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.73.0.1 Source cves: CVE-2023-32323 Source advisory: OSV:PYSEC-2023-67...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2022-39335 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2022-39335 Source advisory: OSV:PYSEC-2023-65...

CVE-2022-39374

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

matrix-synapse-testutils (>=1.65.0.0, <=1.67.0.0) potentially affected by CVE-2022-39374 via matrix-synapse (>=1.65.0, <=1.67.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.67.0.0 Source cves: CVE-2022-39374 Source advisory: MEND:CVE-2022-39374...

CVE-2022-39374

Synapse (Matrix.org) vulnerable to CVE-2022-39374: when a malicious homeserver shares a room with a vulnerable Synapse, it can trick Synapse into accepting previously rejected events, causing subsequent messages and state changes from that server in the room to be rejected. This issue has been pa...

CVE-2022-39374

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

CVE-2022-39374 Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

CVE-2022-39374

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

CVE-2022-39374 Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

CVE-2022-39335 Synapse does not apply enough checks to servers requesting auth events of events in a room

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

CVE-2022-39335

CVE-2022-39335 affects Synapse (Matrix homeserver). The issue: when a home server answers a query for authorization events via the Federation API, it does not sufficiently verify that the requesting server should access those events. This could enable access to authorization events in a room by u...

CVE-2022-39335

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

matrix-synapse-testutils (>=1.65.0.0, <=1.68.0.0), raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2022-39335 via matrix-synapse (>=0.33.9, <=1.68.0)

matrix-synapse PYPI version =0.33.9, =1.65.0.0, =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2022-39335 Source advisory: MEND:CVE-2022-39335...

CVE-2022-39335 Synapse does not apply enough checks to servers requesting auth events of events in a room

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

CVE-2022-39335

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2023-32323

CVE-2023-32323 affects the Synapse Matrix homeserver. The issue stems from an unlimited invite_room_state size in versions up to 1.73, enabling a malicious user with state-event permissions to disrupt outbound federation. A fix was introduced in 1.74, which refuses oversized invite_room_state fie...