GitHub Advisoryadvisory · PyPI

GHSA-5chr-wjw5-3gq4 matrix-synapse vulnerable to denial of service due to malicious server ACL events

MEDIUM Published 2023-10-10 Modified 2024-09-24 Official page ↗
Aliases
CVE-2023-45129
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2023-10-10

Affected packages

• PyPI matrix-synapse: < 1.94.0 → fixed in 1.94.0

Description

Impact A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Patches Server administrators are advised to upgrade to Synapse 1.94.0 or later. Workarounds Rooms with malicious server ACL events can be purged and blocked using the admin API.

Related

Alias · CVE (1)

  • CVE-2023-45129 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References