PT-2020-16383 · Matrix+1 · Matrix Synapse+1

Erikjohnston · Published 2020-12-09 · Updated 2024-06-15 · CVE-2020-26257

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 1.23.1

Description A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of API endpoints such as /send join, /send leave, /invite, or /exchange third party invite. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. The issue affects any server that accepts federation requests from untrusted servers.

Recommendations For versions prior to 1.23.1, update to version 1.23.1 to resolve the issue. As a temporary workaround, homeserver administrators could limit access to the federation API to trusted servers, for example via federation domain whitelist.

Fix

DoS

Special Elements Injection

XSS

Resource Exhaustion

Weakness Enumeration

CWE-74

CWE-79

CWE-400

Related Identifiers

ALT-PU-2021-1385

CVE-2020-26257

GHSA-HXMP-PQCH-C8MM

OPENSUSE-SU-2024:11041-1

PYSEC-2020-236

Affected Products

Alt Linux

Matrix Synapse

References · 44

• https://github.com/matrix-org/synapse/pull/8776 · Patch
• https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b · Patch
• https://ubuntu.com/security/CVE-2020-26257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26257 · Security Note
• https://osv.dev/vulnerability/GHSA-hxmp-pqch-c8mm · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26257 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26257 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26257 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11041-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26257 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26257 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-236 · Vendor Advisory