PT-2019-12525 · Matrix+2 · Matrix Sydent+3

Published 2019-05-09 · Updated 2023-05-16 · CVE-2019-11842

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Matrix Sydent versions prior to 1.0.3 Synapse versions prior to 0.99.3.1

Description An issue was discovered that makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID due to mishandled random number generation.

Recommendations For Matrix Sydent versions prior to 1.0.3, update to version 1.0.3 or later. For Synapse versions prior to 0.99.3.1, update to version 0.99.3.1 or later.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

ALT-PU-2019-1784

CVE-2019-11842

GHSA-GWF7-VFJF-WF6X

PYSEC-2019-185

USN-6076-1

Affected Products

Alt Linux

Matrix Sydent

Synapse

Ubuntu

References · 30

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-11842 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5885 · Security Note
• https://ubuntu.com/security/CVE-2018-10657 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16515 · Security Note
• https://ubuntu.com/security/CVE-2018-12291 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12423 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18835 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gwf7-vfjf-wf6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10657 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11842 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12291 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-11842 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-1784 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6076-1 · Vendor Advisory