PT-2022-20567 · Synapse+1 · Synapse+1

Richvdh · Published 2022-08-31 · Updated 2023-08-05 · CVE-2022-31152

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions up to and including 1.61.0

Description The issue arises from the incorrect application of event authorization rules as specified in the Matrix specification, potentially causing divergence in room state between servers. An attacker could craft events that would be accepted by Synapse but not by a spec-conformant server.

Recommendations For Synapse versions up to and including 1.61.0, upgrade to version 1.62.0 or higher. As a temporary workaround, consider disabling federation by setting federation domain whitelist to an empty list ([]).

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-703

Related Identifiers

ALT-PU-2023-4748

CVE-2022-31152

GHSA-JHJH-776M-4765

PYSEC-2022-262

Affected Products

Alt Linux

Synapse

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31152.json · Exploit
• https://github.com/matrix-org/synapse/pull/13087 · Patch
• https://github.com/matrix-org/synapse/pull/13088 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31152 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31152 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31152 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-262 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31152 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31152 · Security Note
• https://osv.dev/vulnerability/GHSA-jhjh-776m-4765 · Vendor Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.62.0 · Note
• https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765 · Note
• https://github.com/matrix-org/synapse/commit/e16ea87d0f8c4c30cad36f85488eb1f647e640b0 · Note