matrix-synapse vulnerable to denial of service due to malicious server ACL events

中 4.9CVE-2023-45129 · GHSA-5chr-wjw5-3gq4 · PYSEC-2023-199 · 10/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-45129 は matrix-synapse, synapse (matrix) に影響する深刻度「中」 (CVSS 4.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 72.4% より高い）。
対処：1.94.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
matrix-synapse PyPI	`< 1.94.0`	`1.94.0`
synapse matrix	`< 1.94.0`	`1.94.0`

概要

Impact

A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.

Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.

Patches

Server administrators are advised to upgrade to Synapse 1.94.0 or later.

Workarounds

Rooms with malicious server ACL events can be purged and blocked using the admin API.

NVD の説明

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.