Matrix Synapse Security Filtering Flaw

ALTO 7.5CVE-2018-12291 · GHSA-v8wm-g9f2-xjv4 · PYSEC-2026-664 · Published 13/06/2018 · updated 17/06/2026

En resumen

CVE-2018-12291 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a matrix-synapse, synapse (matrix).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.4% de las vulnerabilidades.
Solución: actualizar a 0.31.1 o posterior.

Package	Affected versions	Patched versions
matrix-synapse PyPI	`< 0.31.1`	`0.31.1`
synapse matrix	`< 0.31.1`	`0.31.1`

Description

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

NVD description

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

References

nvd.nist.gov/vuln/detail/CVE-2018-12291 · ADVISORY
matrix-org/synapse#3371 · WEB
matrix-org/synapse commit 0834b49 · WEB
matrix-org/synapse · PACKAGE
matrix-org/synapse release v0.31.1 · WEB
pypi.org/project/matrix-synapse · PACKAGE
GitHub Advisory GHSA-v8wm-g9f2-xjv4 · ADVISORY

Más vulnerabilidades de matrix-synapse

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

matrix-synapse

PyPI

< 0.31.1

0.31.1

synapse

matrix

< 0.31.1

0.31.1

Description

NVD description

Más vulnerabilidades de matrix-synapse

Ver todo →