PT-2019-15690 · Matrix+2 · Matrix Synapse+2

Kyrias · Publicado 2019-11-07 · Atualizado 2023-05-16 · CVE-2019-18835

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 1.5.0

Description The issue concerns the mishandling of signature checking on some federation APIs. Events sent over "/send join", "/send leave", and "/invite" API endpoints may not be correctly signed, or may not come from the expected servers.

Recommendations For Matrix Synapse versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/send join", "/send leave", and "/invite" API endpoints to minimize the risk of exploitation.

Correção

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-345

CWE-347

Identificadores relacionados

ALT-PU-2020-1099

CVE-2019-18835

GHSA-CPPW-2MF8-QPM5

PYSEC-2019-186

USN-6076-1

Produtos afetados

Alt Linux

Matrix Synapse

Ubuntu

Referências · 23

• https://github.com/matrix-org/synapse/pull/6262 · Correção
• https://github.com/matrix-org/synapse/releases/tag/v1.5.0 · Nota
• https://github.com/matrix-org/synapse/commit/172f264ed38e8bef857552f93114b4ee113a880b · Nota
• https://github.com/matrix-org/synapse · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2019-186.yaml · Nota
• https://osv.dev/vulnerability/GHSA-cppw-2mf8-qpm5 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6076-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18835 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-12291 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18835 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-186 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-18835 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-18835 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6076-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-11842 · Aviso do Fabricante