Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-39374 EUVD-2023-0138GHSA-p9qp-c452-f9r7PYSEC-2023-66

Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Published May 26, 2023 · Updated Feb 13, 2025 · Assigned by GitHub_M

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

Affected products

VendorProductAffectedFixed
matrix-org synapse >= 1.62.0, < 1.68.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS matrix-synapse 1.53.0-1ubuntu0.1~esm2 USN-7444-1
Ubuntu Pro 20.04 LTS matrix-synapse 1.11.0-1ubuntu0.1~esm2 USN-7444-1
Ubuntu Pro 18.04 LTS matrix-synapse 0.24.0+dfsg-1ubuntu0.1~esm4 USN-7444-1
ReleasePackageFixed inAdvisory
Alpine v3.24 synapse 1.68.0-r0 —
Alpine v3.23 synapse 1.68.0-r0 —
Alpine v3.22 synapse 1.68.0-r0 —
Alpine v3.21 synapse 1.68.0-r0 —
Alpine v3.20 synapse 1.68.0-r0 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 synapse 1.68.0-r0 —
Alpine v3.18 synapse 1.70.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI matrix-synapse >= 1.62.0, < 1.68.0rc1 1.68.0rc1 GHSA-p9qp-c452-f9r7
PyPI matrix-synapse >= 1.62.0, < 1.68.0 1.68.0 PYSEC-2023-66

Advisories 1

References