CVE-2021-21273

Synapse (matrix-synapse, Python/pypi) contains a vulnerability in versions before 1.25.0 where requests to user-provided domains were not restricted to external IPs when computing the key validity for third-party invite events and push notifications. This could allow requests to internal infrastr...

CVE-2021-21273

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

CVE-2021-21274

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

CVE-2021-21274

CVE-2021-21274 affects Synapse (matrix-synapse) prior to version 1.25.0. A malicious homeserver could abuse .well-known redirection to a large file, causing denial of service by consuming significant resources on federated requests from untrusted servers. The issue is resolved in Synapse 1.25.0. ...

CVE-2021-21274 Denial of service attack via .well-known lookups

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

CVE-2021-21274

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

CVE-2021-21274: Uncontrolled Resource Consumption

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

Matrix Synapse 资源管理错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A denial of service vulnerability exists in Synapse versions prior to 1.25.0, which stems from a malicious homeserver that redirects requests to a large file, which could lead to a denial of service...

Matrix Synapse Input Validation Error Vulnerability

Matrix Synapse is an implementation of a matrix management server from the Matrix Foundation in the UK. A security vulnerability exists in Synapse that stems from a request to a user-provided domain being unrestricted by an external IP address when calculating key validity for third-party...

CVE-2021-21273: URL Redirection to Untrusted Site

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

PT-2021-14472

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0 Description The issue is related to missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could cause excessive use of disk space and memory leading to...

PT-2021-14473

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0 Description The issue is caused by missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could lead to excessive use of disk space and memory, resulting in...

PT-2021-14471

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0 Description The issue affects Synapse, a Matrix reference homeserver written in python, where requests to user-provided domains were not restricted to external IP addresses when transitional IPv6 addresses were...

PT-2021-14381 · Synapse +1 · Synapse +1

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.25.0 Description: A malicious homeserver could redirect requests to their .well-known file to a large file, leading to a denial of service attack where homeservers consume significantly more resources when requesti...

PT-2021-14427

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.27.0 Description The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow...

PT-2021-14380

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.25.0 Description: The issue concerns Synapse, a Matrix reference homeserver written in python, where requests to user-provided domains were not restricted to external IP addresses when calculating key validity for...

PT-2021-14428 · Synapse +1 · Synapse +1

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.27.0 Description: The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow a...

Fedora 32 : matrix-synapse (2020-a2172c484d)

Upstream release notes: https://github.com/matrix-org/synapse/blob/master/CHANGES.mdsynapse-1 240rc1-2020-12-02 This release includes some minor changes which may affect homeserver admins: https://github.com/matrix-org/synapse/blob/develop/UPGRADE.rstupgradi ng-to-v1240 Note that Tenable Network...

Fedora 33 : matrix-synapse (2020-eeb66c2ece)

Upstream release notes: https://github.com/matrix-org/synapse/blob/master/CHANGES.mdsynapse-1 240rc1-2020-12-02 This release includes some minor changes which may affect homeserver admins: https://github.com/matrix-org/synapse/blob/develop/UPGRADE.rstupgradi ng-to-v1240 Note that Tenable Network...

[SECURITY] Fedora 33 Update: matrix-synapse-1.24.0-1.fc33

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...