Matrix Synapse Denial of Service Vulnerability

Matrix is a set of open communication networks of which Synapse is a server implementation. A denial of service vulnerability exists in Matrix Synapse versions prior to 0.28.1. An attacker can exploit this vulnerability to cause a denial of service with the 'depth' value...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

Design/Logic Flaw

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

DEBIAN-CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

UBUNTU-CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is vulnerable to a denial-of-service (DoS) flaw triggered by specially crafted events with depth = 2^63 − 1, rendering rooms unusable. The issue is tied to federation/federation_base.py and handlers/message.py. Exploitation was observed in the wild in April 2018. Reme...

PT-2018-10035

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 0.28.1 Description The issue is a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable. This is related to the files federation/federation base.py and...

VulnCheck KEV: CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

Razer US: Razer Synapse 3 Local Privilege Escalation

Excellent report from @achapman. We appreciate the time, effort, technical skill, and professionalism of the researcher in helping us find and fix this issue...

Apache Synapse远程命令执行漏洞(CVE-2017-15708)

0X00 介绍 Apache Synapse是一种轻量级的高性能企业服务总线（ESB）。Apache Synapse由快速和异步的中介引擎提供支持，为XML、Web服务和REST提供了卓越的支持。 0X01 分析 我们知道，完成反序列化漏洞需要存在两个条件： 存在反序列化对象数据传输 有缺陷的第三方lib库，例如Apache Commons Collections 在FoxGlove Security安全团队的@breenmachine的博文中，总结了非常全面可能使用反序列化的地方： 在HTTP请求中 RMI，RMI在传输过程中一定会使用序列化和反序列化...

Remote code execution

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

CVE-2017-15708

CVE-2017-15708 affects Apache Synapse: by default no authentication for Java RMI, enabling remote code execution through specially crafted serialized objects when Commons Collections 3.2.1 or earlier are present. IBM and related bulletins reiterate the issue and note that upgrading to Synapse 3.0...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

Remote Code Execution (RCE)

Apache Synapse uses a vulnerable version of commons-collections. This allows attackers to exploit the use of the vulnerable library to perform remote code execution RCE attacks...