PT-2023-13719 · Synapse+3 · Synapse+3

Kasak · Publicado 2023-05-24 · Atualizado 2025-04-22 · CVE-2022-39335

Positive Technologies (AI Summary)

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions up to and including 1.68.0

Description The Matrix Federation API in Synapse allows remote homeservers to request authorization events in a room, which is necessary for validating the legitimacy and permission of events. However, in affected versions, a Synapse homeserver does not sufficiently check if the requesting server should be able to access these events. This issue can be exploited when a malicious actor knows the ID of a target room and the ID of an event from that room. The issue is of negligible consequence for public rooms and deployments in a closed federation where all homeservers are trustworthy.

Recommendations For Synapse versions up to and including 1.68.0, upgrade to Synapse 1.69.0 to resolve the issue. As a temporary workaround, consider configuring Synapse with a list of trusted servers using the federation domain whitelist to restrict access, but this is not practical for homeservers participating in open federation.

Exploit

Correção

Missing Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-862

CWE-200

Identificadores relacionados

ALT-PU-2023-4748

CVE-2022-39335

GHSA-45CJ-F97F-GGWV

PYSEC-2023-65

USN-7444-1

Produtos afetados

Alt Linux

Linuxmint

Synapse

Ubuntu

Referências · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39335.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv · Aviso do Fabricante
• https://github.com/matrix-org/synapse/pull/13823 · Correção
• https://github.com/matrix-org/synapse/issues/13288 · Nota
• https://github.com/matrix-org/synapse · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-65.yaml · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39335 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-39335 · Nota de Segurança
• https://osv.dev/vulnerability/USN-7444-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-39335 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-42453 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-39335 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-7444-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-39335 · Aviso do Fabricante