GitHub Advisoryadvisory · PyPI

GHSA-f3r3-h2mq-hx2h Synapse allows a a malformed invite to break the invitee's `/sync`

HIGH Published 2024-12-03 Modified 2024-12-03 Official page ↗
Aliases
CVE-2024-52815
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-20
Reviewed
2024-12-03

Affected packages

• PyPI matrix-synapse: < 1.120.1 → fixed in 1.120.1

Description

Impact Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's `/sync` functionality. Patches Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users. Workarounds Server administrators can disable federation from untrusted servers. For more information If you have any questions or comments about this advisory, please email us at security at element.io.

Related

Alias · CVE (1)

  • CVE-2024-52815 Synapse is an open-source Matrix homeserver. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References