PT-2018-11162 · Matrix.Org+2 · Synapse+2

Matthew Hodgson · Publicado 2018-06-14 · Atualizado 2023-05-16 · CVE-2018-12423

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 0.31.2

Description The issue allows unauthorized users to hijack rooms when there is no m.room.power levels event in force. This can lead to unauthorized access and control over rooms.

Recommendations For versions prior to 0.31.2, update to version 0.31.2 or later to resolve the issue. As a temporary workaround, consider implementing strict access controls to rooms and ensuring that m.room.power levels events are properly configured to minimize the risk of exploitation.

Correção

Identificadores relacionados

ALT-PU-2018-1973

CVE-2018-12423

GHSA-CH5V-FHG8-7GV9

USN-6076-1

Produtos afetados

Alt Linux

Synapse

Ubuntu

Referências · 21

• https://github.com/matrix-org/synapse/pull/3397 · Nota
• https://github.com/matrix-org/synapse · Nota
• https://github.com/matrix-org/matrix-doc/issues/1304 · Nota
• https://ubuntu.com/security/notices/USN-6076-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-12291 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12423 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2018-12423 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ch5v-fhg8-7gv9 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-12423 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6076-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12423 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-5885 · Aviso do Fabricante
• https://matrix.org/blog/2018/06/14/security-update-synapse-0-31-2 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10657 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-12423 · Aviso do Fabricante