matrix-synapse 1.105.0 vulnerabilities

Known vulnerabilities in the matrix-synapse package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Improper Input Validation matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Improper Input Validation. A malicious server can disrupt the normal operation and prevent the application from federating with other servers by crafting events that exploit this flaw. Note: This is only exploitable in environments where federation is enabled. How to fix Improper Input Validation? Upgrade `matrix-synapse` to version 1.127.1 or higher.	[,1.127.1)
H Improper Input Validation matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Improper Input Validation via invite messages. An attacker can disrupt the `/sync` functionality by sending a specially crafted invite over federation. How to fix Improper Input Validation? Upgrade `matrix-synapse` to version 1.120.2 or higher.	[,1.120.2)
H Allocation of Resources Without Limits or Throttling matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the media download process. An attacker can induce the server to download and cache large amounts of remote media, leading to disk space exhaustion by sending repeated requests for large files. Note: This is only exploitable if the server has not implemented sufficient rate limiting or file size restrictions. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `matrix-synapse` to version 1.106.0 or higher.	[,1.106.0)
M Missing Authentication for Critical Function matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the unauthenticated writes to the media repository. An attacker can plant problematic content into the media repository by exploiting this functionality. How to fix Missing Authentication for Critical Function? Upgrade `matrix-synapse` to version 1.106.0 or higher.	[,1.106.0)
H Arbitrary File Upload matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Arbitrary File Upload due to the `dynamic_thumbnails` option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or cause a denial of service by invoking external, potentially untrustworthy decoders. How to fix Arbitrary File Upload? Upgrade `matrix-synapse` to version 1.120.2 or higher.	[,1.120.2)
H Allocation of Resources Without Limits or Throttling matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of `multipart/form-data` content types. An attacker can amplify denial of service attacks by sending crafted requests that transiently increase memory consumption. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `matrix-synapse` to version 1.120.2 or higher.	[,1.120.2)
M Allocation of Resources Without Limits or Throttling matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the `auth chain cover index` is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `matrix-synapse` to version 1.105.1 or higher.	[,1.105.1)

Vulnerability

Vulnerable Version

Improper Input Validation

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Improper Input Validation. A malicious server can disrupt the normal operation and prevent the application from federating with other servers by crafting events that exploit this flaw.

Note:

This is only exploitable in environments where federation is enabled.

How to fix Improper Input Validation?

Upgrade matrix-synapse to version 1.127.1 or higher.

[,1.127.1)

Improper Input Validation

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Improper Input Validation via invite messages. An attacker can disrupt the /sync functionality by sending a specially crafted invite over federation.

How to fix Improper Input Validation?

Upgrade matrix-synapse to version 1.120.2 or higher.

[,1.120.2)

Allocation of Resources Without Limits or Throttling

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the media download process. An attacker can induce the server to download and cache large amounts of remote media, leading to disk space exhaustion by sending repeated requests for large files.

Note:

This is only exploitable if the server has not implemented sufficient rate limiting or file size restrictions.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade matrix-synapse to version 1.106.0 or higher.

[,1.106.0)

Missing Authentication for Critical Function

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the unauthenticated writes to the media repository. An attacker can plant problematic content into the media repository by exploiting this functionality.

How to fix Missing Authentication for Critical Function?

Upgrade matrix-synapse to version 1.106.0 or higher.

[,1.106.0)

Arbitrary File Upload

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Arbitrary File Upload due to the dynamic_thumbnails option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or cause a denial of service by invoking external, potentially untrustworthy decoders.

How to fix Arbitrary File Upload?

Upgrade matrix-synapse to version 1.120.2 or higher.

[,1.120.2)

Allocation of Resources Without Limits or Throttling

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of multipart/form-data content types. An attacker can amplify denial of service attacks by sending crafted requests that transiently increase memory consumption.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade matrix-synapse to version 1.120.2 or higher.

[,1.120.2)

Allocation of Resources Without Limits or Throttling

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the auth chain cover index is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade matrix-synapse to version 1.105.1 or higher.

[,1.105.1)

matrix-synapse@1.105.0 vulnerabilities

Homeserver for the Matrix decentralised comms protocol

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?