Insecure Randomness Affecting matrix-synapse package, versions [,0.99.3.1)
Threat Intelligence
EPSS
0.17% (55th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MATRIXSYNAPSE-1571829
- published 30 Aug 2021
- disclosed 9 May 2019
- credit Enguerran Gillier
Introduced: 9 May 2019
CVE-2019-11842 Open this link in a new tabHow to fix?
Upgrade matrix-synapse
to version 0.99.3.1 or higher.
Overview
matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.
Affected versions of this package are vulnerable to Insecure Randomness. Random IDs and authentication tokens are generated using an insecure random number generator, allowing an attacker to predict these values.
References
CVSS Scores
version 3.1