Improper Verification of Cryptographic Signature in matrix-synapse

CRÍTICO 9.8CVE-2019-18835 · GHSA-cppw-2mf8-qpm5 · PYSEC-2019-186 · Published 08/11/2019 · updated 17/06/2026

En resumen

CVE-2019-18835 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a matrix-synapse, synapse (matrix).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.86%, mayor que el 58.6% de las vulnerabilidades.
Solución: actualizar a 1.5.0 o posterior.

Package	Affected versions	Patched versions
matrix-synapse PyPI	`< 1.5.0`	`1.5.0`
synapse matrix	`< 1.5.0`	`1.5.0`

Description

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

NVD description

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

References

nvd.nist.gov/vuln/detail/CVE-2019-18835 · ADVISORY
matrix-org/synapse#6262 · WEB
matrix-org/synapse commit 172f264 · WEB
matrix-org/synapse · PACKAGE
matrix-org/synapse release v1.5.0 · WEB
pypa/advisory-database · WEB
GitHub Advisory GHSA-cppw-2mf8-qpm5 · ADVISORY

Más vulnerabilidades de matrix-synapse

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

matrix-synapse

PyPI

< 1.5.0

1.5.0

synapse

matrix

< 1.5.0

1.5.0

Description

NVD description

Más vulnerabilidades de matrix-synapse

Ver todo →