CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

matrix-synapse-testutils (>=1.65.0.0, <=1.73.0.1), raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2023-32323 via matrix-synapse (>=0.33.9, <=1.73.0)

matrix-synapse PYPI version =0.33.9, =1.65.0.0, =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2023-32323 Source advisory: MEND:CVE-2023-32323...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

Matrix Synapse Input Validation Vulnerability

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability exists in Matrix Synapse that originates from the fact that a malicious user on Synapse master server X who is authorized to create certain state events can disable outbound...

CVE-2022-39374

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

CVE-2022-39335

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

CVE-2023-32323

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

CVE-2022-39374: Uncontrolled Resource Consumption

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that...

Matrix Synapse information leakage vulnerability

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability exists in Matrix Synapse that stems from the Synapse master server answering authorization event queries not adequately checking whether the requesting server should be able ...

Matrix Resource Management Error Vulnerability

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. Matrix Synapse suffers from a security vulnerability that stems from the fact that if both Synapse and a malicious home server join the same room, the malicious home server can trick Synapse into...

CVE-2022-39335: Exposure of Sensitive Information to an Unauthorized Actor

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are...

matrix-synapse-testutils (>=1.65.0.0, <=1.73.0.1) potentially affected by CVE-2023-32323 via matrix-synapse (>=1.65.0, <=1.73.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.73.0.1 Source cves: CVE-2023-32323 Source advisory: GHSA-F3WC-3VXV-XMVR...

GHSA-F3WC-3VXV-XMVR Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Impact A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. Details The Matrix protocol allows homeservers to provide an...

matrix-synapse-testutils (>=1.65.0.0, <=1.73.0.1) potentially affected by CVE-2023-32323 via matrix-synapse (>=1.65.0, <=1.73.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.73.0.1 Source cves: CVE-2023-32323 Source advisory: OSV:GHSA-F3WC-3VXV-XMVR...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2023-32323 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2023-32323 Source advisory: OSV:GHSA-F3WC-3VXV-XMVR...

matrix-synapse-testutils (>=1.65.0.0, <=1.67.0.0) potentially affected by CVE-2022-39374 via matrix-synapse (>=1.65.0, <=1.67.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.67.0.0 Source cves: CVE-2022-39374 Source advisory: OSV:GHSA-P9QP-C452-F9R7...

matrix-synapse-testutils (>=1.65.0.0, <=1.67.0.0) potentially affected by CVE-2022-39374 via matrix-synapse (>=1.65.0, <=1.67.0)

matrix-synapse PYPI version =1.65.0, =1.65.0.0, =1.67.0.0 Source cves: CVE-2022-39374 Source advisory: GHSA-P9QP-C452-F9R7...

GHSA-45CJ-F97F-GGWV Synapse does not apply enough checks to servers requesting auth events of events in a room

Impact Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorisation events of events in a room. This is necessary so that a homeserver receiving some events can validate that those...

raiden (>=0.100.2rc4, <=0.100.3rc1) potentially affected by CVE-2022-39335 via matrix-synapse (0.33.9)

matrix-synapse PYPI version 0.33.9 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - raiden =0.100.2rc4, =0.100.3rc1 Source cves: CVE-2022-39335 Source advisory: OSV:GHSA-45CJ-F97F-GGWV...