Improper Verification of Cryptographic Signature in matrix-synapse

CRITICO 9.8CVE-2019-18835 · GHSA-cppw-2mf8-qpm5 · PYSEC-2019-186 · Published 08/11/2019 · updated 17/06/2026

In breve

CVE-2019-18835 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda matrix-synapse, synapse (matrix).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.86%, superiore al 58.6% delle vulnerabilità.
Correzione: aggiornare a 1.5.0 o successiva.

Package	Affected versions	Patched versions
matrix-synapse PyPI	`< 1.5.0`	`1.5.0`
synapse matrix	`< 1.5.0`	`1.5.0`

Description

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

NVD description

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

References

nvd.nist.gov/vuln/detail/CVE-2019-18835 · ADVISORY
matrix-org/synapse#6262 · WEB
matrix-org/synapse commit 172f264 · WEB
matrix-org/synapse · PACKAGE
matrix-org/synapse release v1.5.0 · WEB
pypa/advisory-database · WEB
GitHub Advisory GHSA-cppw-2mf8-qpm5 · ADVISORY

Altre vulnerabilità di matrix-synapse

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

matrix-synapse

PyPI

< 1.5.0

1.5.0

synapse

matrix

< 1.5.0

1.5.0

Description

NVD description

Altre vulnerabilità di matrix-synapse

Vedi tutto →