PT-2019-15690 · Matrix+2 · Matrix Synapse+2

Kyrias · Published 2019-11-07 · Updated 2023-05-16 · CVE-2019-18835

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 1.5.0

Description The issue concerns the mishandling of signature checking on some federation APIs. Events sent over "/send join", "/send leave", and "/invite" API endpoints may not be correctly signed, or may not come from the expected servers.

Recommendations For Matrix Synapse versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/send join", "/send leave", and "/invite" API endpoints to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

ALT-PU-2020-1099

CVE-2019-18835

GHSA-CPPW-2MF8-QPM5

PYSEC-2019-186

USN-6076-1

Affected Products

Alt Linux

Matrix Synapse

Ubuntu

References · 23

• https://github.com/matrix-org/synapse/pull/6262 · Patch
• https://osv.dev/vulnerability/GHSA-cppw-2mf8-qpm5 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6076-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18835 · Security Note
• https://ubuntu.com/security/CVE-2018-12291 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18835 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-186 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18835 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-18835 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6076-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11842 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5885 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10657 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12423 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16515 · Vendor Advisory