Homepage

matrix-synapse@1.109.0 vulnerabilities

Homeserver for the Matrix decentralised comms protocol

  • latest version

    1.144.0

  • latest non vulnerable version

    1.144.0

  • first published

    7 years ago

  • latest version published

    4 days ago

  • licenses detected

  • View matrix-synapse package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the matrix-synapse package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Validation of Specified Type of Input

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input due to insufficient validation of device keys. An attacker can disrupt federation functionality and unpredictably break outbound federation to other homeservers by registering on the victim homeserver and submitting invalid device keys. This is only exploitable if the attacker is a registered user on the victim homeserver.

    Note

    Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, we recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.

    How to fix Improper Validation of Specified Type of Input?

    Upgrade matrix-synapse to version 1.138.3, 1.139.1 or higher.

    [,1.138.3)[1.139.0rc2,1.139.1)
    • H
    Improper Input Validation

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Input Validation. A malicious server can disrupt the normal operation and prevent the application from federating with other servers by crafting events that exploit this flaw.

    Note:

    This is only exploitable in environments where federation is enabled.

    How to fix Improper Input Validation?

    Upgrade matrix-synapse to version 1.127.1 or higher.

    [,1.127.1)
    • H
    Improper Input Validation

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Input Validation via invite messages. An attacker can disrupt the /sync functionality by sending a specially crafted invite over federation.

    How to fix Improper Input Validation?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    • H
    Arbitrary File Upload

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Arbitrary File Upload due to the dynamic_thumbnails option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or cause a denial of service by invoking external, potentially untrustworthy decoders.

    How to fix Arbitrary File Upload?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    • H
    Allocation of Resources Without Limits or Throttling

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of multipart/form-data content types. An attacker can amplify denial of service attacks by sending crafted requests that transiently increase memory consumption.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    Go back to all versions of this package