Cleartext Storage of Sensitive Information Affecting matrix-synapse package, versions <1.93.0-1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-MATRIXSYNAPSE-5922061
- published 28 Sep 2023
- disclosed 27 Sep 2023
Introduced: 27 Sep 2023
CVE-2023-41335 Open this link in a new tabHow to fix?
Upgrade Debian:unstable matrix-synapse to version 1.93.0-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream matrix-synapse package and not the matrix-synapse package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
References
- https://security-tracker.debian.org/tracker/CVE-2023-41335
- https://github.com/matrix-org/synapse/pull/16272
- https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
- https://security.gentoo.org/glsa/202401-12