PT-2023-13722 · Synapse+2 · Synapse+2

Kasak · Publicado 2023-05-24 · Atualizado 2025-04-22 · CVE-2022-39374

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.68.0

Description The issue occurs when Synapse and a malicious homeserver are both joined to the same room. The malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. Synapse homeservers are affected if they are joined to rooms with members of untrusted homeservers.

Recommendations For Synapse versions prior to 1.68.0, upgrade to version 1.68.0 or higher to resolve the issue. As a temporary workaround, consider disabling federation by setting federation domain whitelist to an empty list ([]). This can help minimize the risk of exploitation until a patch is applied.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2022-39374

GHSA-P9QP-C452-F9R7

PYSEC-2023-66

USN-7444-1

Produtos afetados

Linuxmint

Synapse

Ubuntu

Referências · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39374.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 · Aviso do Fabricante
• https://github.com/matrix-org/synapse/pull/13723 · Correção
• https://github.com/matrix-org/synapse/commit/b73cbb82157d9666e8d667733afebc0d09ed858c · Nota
• https://github.com/matrix-org/synapse · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-66.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-39374 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p9qp-c452-f9r7 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-7444-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-42453 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2209956 · Nota
• https://ubuntu.com/security/notices/USN-7444-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-53863 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-32683 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-39335 · Aviso do Fabricante