high7.5
CVE-2019-11842
matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
Impact
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | matrix-sydent | < 1.0.3 | 1.0.3 |
| pip | matrix-synapse | < 0.99.3.1 | 0.99.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matrix | Sydent | before 1.0.3 |
| Matrix | Synapse | before 0.99.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
- https://github.com/advisories/GHSA-gwf7-vfjf-wf6x
- https://nvd.nist.gov/vuln/detail/CVE-2019-11842
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2019-185.yaml
- https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a