GitHub Advisoryadvisory · PyPI

GHSA-7565-cq32-vx2x matrix-synapse vulnerable to improper validation of receipts allows forged read receipts

MEDIUM Published 2023-09-26 Modified 2024-09-24 Official page ↗
Aliases
CVE-2023-42453
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-285
Reviewed
2023-09-26

Affected packages

• PyPI matrix-synapse: >= 0.34.0, < 1.93.0 → fixed in 1.93.0

Description

Impact Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. Patches https://github.com/matrix-org/synapse/pull/16327 Workarounds There is no workaround.

Related

Alias · CVE (1)

  • CVE-2023-42453 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References