matrix-synapse@1.81.0rc1 vulnerabilities

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the auth chain cover index is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events.

Upgrade matrix-synapse to version 1.105.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure. An attacker can query remote users' device information which can be used to enumerate the remote users known to a homeserver.

Upgrade matrix-synapse to version 1.95.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ACL event. An attacker can cause a denial of service by sending a malicious ACL event.

Upgrade matrix-synapse to version 1.94.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Improper Input Validation due to the improper validation of receipts. An attacker can forge read receipts for any event by knowing the room ID and event ID.

Upgrade matrix-synapse to version 1.93.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure due to temporarily stored plaintext passwords in the server database. An attacker can potentially access these passwords if they have access to the database backups.

Upgrade matrix-synapse to version 1.93.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Incorrect Authorization in that it does not check for deactivated status of users during login, under certain conditions. Specifically, JSON Web Tokens must be enabled via the jwt_config.enabled setting, the local password database must be enabled via the password_config.enabled and password_config.localdb_enabled settings, and a user's password must be updated via an admin API after a user is deactivated.

NOTE: Installations configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.

If not using JSON Web Tokens, the list of deactivated users with a password set can be queried from PostgreSQL:

SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;

Upgrade matrix-synapse to version 1.85.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by bypassing the url_preview_url_blacklist deny list with oEmbed or image URLs used in previews. An attacker can bypass the deny list by including an IP address that is allowed by the url_preview_ip_range_blacklist setting (only public addresses by default). The information exposed by the client is limited by the following conditions:

• For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded.

• For discovered image URLs, any non-image response is discarded.

Upgrade matrix-synapse to version 1.85.0rc1 or higher.