Summary
It was discovered that Synapse network policies could be bypassed via
specially crafted URLs. An attacker could possibly use this issue to
bypass authentication mechanisms. (CVE-2023-32683)
It was discovered that Synapse exposed cached device information. An
attacker could possibly use this issue to gain access to sensitive
information. (CVE-2023-43796)
It was discovered that Synapse could be tricked into rejecting state
changes in rooms. An attacker could possibly use this issue to cause
Synapse to stop functioning properly, resulting in a denial of service.
This issue was only fixed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-39374)
It was discovered that Synapse stored user credentials in a server's
database temporarily. An attacker could possibly use this issue to
gain access to sensitive information. This issue was only fixed in
Ubuntu 22.04 LTS. (CVE-2023-41335)
It was discovered that Synapse could incorrectly respond to server
authorization events. An attacker could possibly use this issue to
bypass authentication mechanisms. This issue was only fixed in Ubuntu
22.04 LTS. (CVE-2022-39335)
It was discovered that Synapse could be manipulated to mark messages
as read when they had not been viewed. An attacker could possibly use
this issue to perform repudiation-based attacks. This issue was only
fixed in Ubuntu 22.04 LTS. (CVE-2023-42453)
It was discovered that Synapse had several memory-related issues. An
attacker could possibly use this issue to cause Synapse to crash,
resulting in a denial of service. This issue was only fixed in Ubuntu
22.04 LTS. (CVE-2024-31208)
It was discovered that Synapse could run external tools due to a
unchecked thumbnail rendering routine. An attacker could possibly use
this issue to cause Synapse to crash, resulting in a denial of service,
or execute arbitrary code. This issue was only fixed in Ubuntu
22.04 LTS. (CVE-2024-53863)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | matrix-synapse | 0.24.0+dfsg-1ubuntu0.1~esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | matrix-synapse | 1.11.0-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | matrix-synapse | 1.53.0-1ubuntu0.1~esm2 |
Vulnerabilities 8
-
High 8.2
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoki…
-
Medium 6.5
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into …
-
Medium 6.5
Synapse's V2 state resolution weakness allows DoS from remote room members
Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce hi…
-
Medium 5.3
Synapse vulnerable to leak of remote user device information
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encourag…
-
Medium 5.0
Synapse does not apply enough checks to servers requesting auth events of events in a room
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events ca…
-
Low 3.7
Temporary storage of plaintext passwords during password changes in matrix synapse
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it a…
-
Low 3.5
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is…
-
Low 3.1
Improper validation of receipts allows forged read receipts in matrix synapse
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mar…
References
-
report
https://ubuntu.com/security/CVE-2022-39335
-
report
https://ubuntu.com/security/CVE-2022-39374
-
report
https://ubuntu.com/security/CVE-2023-32683
-
report
https://ubuntu.com/security/CVE-2023-41335
-
report
https://ubuntu.com/security/CVE-2023-42453
-
report
https://ubuntu.com/security/CVE-2023-43796
-
report
https://ubuntu.com/security/CVE-2024-31208
-
report
https://ubuntu.com/security/CVE-2024-53863