CVE-2018-10657

2018-05-0200:00:00

ubuntu.com

0.001 Low

EPSS

Percentile

41.5%

JSON

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where
malicious events injected with depth = 2^63 - 1 render rooms unusable,
related to federation/federation_base.py and handlers/message.py, as
exploited in the wild in April 2018.

Notes

Author	Note
leosilva	code is quite different in bionic and artful versus patch.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchmatrix-synapse< 0.24.0+dfsg-1ubuntu0.1~esm1UNKNOWN
ubuntu18.10noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu19.04noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu19.10noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu20.04noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu20.10noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu21.04noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu21.10noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu22.04noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN
ubuntu22.10noarchmatrix-synapse< 0.28.1+dfsg-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	matrix-synapse	< 0.24.0+dfsg-1ubuntu0.1~esm1	UNKNOWN
ubuntu	18.10	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	19.04	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	19.10	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	20.04	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	20.10	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	21.04	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	21.10	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	22.04	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN
ubuntu	22.10	noarch	matrix-synapse	< 0.28.1+dfsg-1	UNKNOWN