Matrix Synapse Security Filtering Flaw

ALTO 7.5CVE-2018-12291 · GHSA-v8wm-g9f2-xjv4 · PYSEC-2026-664 · Published 13/06/2018 · updated 17/06/2026

In breve

CVE-2018-12291 è una vulnerabilità ALTO (CVSS 7.5) che riguarda matrix-synapse, synapse (matrix).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.4% delle vulnerabilità.
Correzione: aggiornare a 0.31.1 o successiva.

Package	Affected versions	Patched versions
matrix-synapse PyPI	`< 0.31.1`	`0.31.1`
synapse matrix	`< 0.31.1`	`0.31.1`

Description

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

NVD description

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

References

nvd.nist.gov/vuln/detail/CVE-2018-12291 · ADVISORY
matrix-org/synapse#3371 · WEB
matrix-org/synapse commit 0834b49 · WEB
matrix-org/synapse · PACKAGE
matrix-org/synapse release v0.31.1 · WEB
pypi.org/project/matrix-synapse · PACKAGE
GitHub Advisory GHSA-v8wm-g9f2-xjv4 · ADVISORY

Altre vulnerabilità di matrix-synapse

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

matrix-synapse

PyPI

< 0.31.1

0.31.1

synapse

matrix

< 0.31.1

0.31.1

Description

NVD description

Altre vulnerabilità di matrix-synapse

Vedi tutto →