CVE-2023-45129

Name
CVE-2023-45129
Description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version
MISC https://github.com/matrix-org/synapse/pull/16360
MISC https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
security-advisories@github.com https://security.gentoo.org/glsa/202401-12

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* synapse >= None < 1.94.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status