Insufficient Verification of Data Authenticity Affecting matrix-synapse package, versions [,1.5.0rc2)
Threat Intelligence
EPSS
0.24% (63rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MATRIXSYNAPSE-480456
- published 8 Nov 2019
- disclosed 8 Nov 2019
- credit Unknown
Introduced: 8 Nov 2019
CVE-2019-18835 Open this link in a new tabHow to fix?
Upgrade matrix-synapse to version 1.5.0rc2 or higher.
Overview
matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity
as it mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from expected hosts.
References
CVSS Scores
version 3.1