high8.8
CVE-2018-16515
Matrix Synapse Improper Signature Validation
Impact
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | matrix-synapse | >= 0.33.3, < 0.33.3.1 | 0.33.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matrix | Synapse | before 0.33.3.1 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/matrix-org/synapse/issues/3796#event-1833126269
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRW7YR2H3ASUSYX4AO4KMY3FNVDNYW3P/
- https://matrix.org/blog/2018/09/06/critical-security-update-synapse-0-33-3-1/
- https://github.com/advisories/GHSA-fmvh-rvq5-hhjx
- https://nvd.nist.gov/vuln/detail/CVE-2018-16515
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRW7YR2H3ASUSYX4AO4KMY3FNVDNYW3P/
- https://github.com/matrix-org/synapse/commit/5bf8bc79ebc22c61968f2eb487714813fccbdb9b
- https://github.com/matrix-org/synapse/commit/804dd41e18c449e711e443398b95c9f6c68b6fa2
- https://github.com/matrix-org/synapse/commit/a5a0bf5cf71caed3c4e3677d2bce667c147dadfc
- https://github.com/matrix-org/synapse/commit/c127c8d0421f0228a46ebbe280c9537e8d8ea42b