PT-2018-13604 · Matrix+2 · Matrix Synapse+2

Richvdh · Publicado 2018-09-18 · Atualizado 2023-05-16 · CVE-2018-16515

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 0.33.3.1 Matrix Synapse version 0.33.2.1

Description The issue allows remote attackers to spoof events and possibly have other impacts by leveraging improper transaction and event signature validation.

Recommendations For Matrix Synapse versions prior to 0.33.3.1, update to version 0.33.3.1 or later. For Matrix Synapse version 0.33.2.1, update to version 0.33.3.1 or later.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

ALT-PU-2018-2390

CVE-2018-16515

GHSA-FMVH-RVQ5-HHJX

USN-6076-1

Produtos afetados

Alt Linux

Matrix Synapse

Ubuntu

Referências · 27

• https://github.com/matrix-org/synapse/issues/3796#event-1833126269 · Correção
• https://github.com/matrix-org/synapse/commit/804dd41e18c449e711e443398b95c9f6c68b6fa2 · Nota
• https://github.com/matrix-org/synapse/commit/5bf8bc79ebc22c61968f2eb487714813fccbdb9b · Nota
• https://github.com/matrix-org/synapse/commit/c127c8d0421f0228a46ebbe280c9537e8d8ea42b · Nota
• https://github.com/matrix-org/synapse/issues/3796 · Nota
• https://github.com/matrix-org/synapse/commit/a5a0bf5cf71caed3c4e3677d2bce667c147dadfc · Nota
• https://github.com/matrix-org/synapse · Nota
• https://ubuntu.com/security/notices/USN-6076-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IRW7YR2H3ASUSYX4AO4KMY3FNVDNYW3P · Aviso do Fabricante
• https://matrix.org/blog/2018/09/06/critical-security-update-synapse-0-33-3-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-12291 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16515 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16515 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRW7YR2H3ASUSYX4AO4KMY3FNVDNYW3P · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-16515 · Aviso do Fabricante