Ubuntu.comUB:CVE-2022-39335CVE-2022-39335
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.6%
Synapse is an open-source Matrix homeserver written and maintained by the
Matrix.org Foundation. The Matrix Federation API allows remote homeservers
to request the authorization events in a room. This is necessary so that a
homeserver receiving some events can validate that those events are
legitimate and permitted in their room. However, in versions of Synapse up
to and including 1.68.0, a Synapse homeserver answering a query for
authorization events does not sufficiently check that the requesting server
should be able to access them. The issue was patched in Synapse 1.69.0.
Homeserver administrators are advised to upgrade.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | matrix-synapse | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | matrix-synapse | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | matrix-synapse | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | matrix-synapse | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | matrix-synapse | < any | UNKNOWN |
References
github.com/matrix-org/synapse/issues/13288
github.com/matrix-org/synapse/pull/13823
github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv
launchpad.net/bugs/cve/CVE-2022-39335
nvd.nist.gov/vuln/detail/CVE-2022-39335
security-tracker.debian.org/tracker/CVE-2022-39335
www.cve.org/CVERecord?id=CVE-2022-39335
Related
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.6%