GitHub Advisoryadvisory · PyPI

GHSA-fmvh-rvq5-hhjx Matrix Synapse Improper Signature Validation

HIGH Published 2022-05-13 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-16515
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2023-07-24

Affected packages

• PyPI matrix-synapse: >= 0.33.3, < 0.33.3.1 → fixed in 0.33.3.1 • PyPI matrix-synapse: < 0.33.2.1 → fixed in 0.33.2.1

Description

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.

Related

Alias · CVE (1)

  • CVE-2018-16515 Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References