matrix-synapse vulnerable to denial of service due to malicious server ACL events

TRUNG BÌNH 4.9CVE-2023-45129 · GHSA-5chr-wjw5-3gq4 · PYSEC-2023-199 · Công bố 10/10/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-45129 là lỗ hổng mức TRUNG BÌNH (CVSS 4.9) ảnh hưởng matrix-synapse, synapse (matrix).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 72.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.94.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
matrix-synapse PyPI	`< 1.94.0`	`1.94.0`
synapse matrix	`< 1.94.0`	`1.94.0`

Mô tả

Impact

A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.

Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.

Patches

Server administrators are advised to upgrade to Synapse 1.94.0 or later.

Workarounds

Rooms with malicious server ACL events can be purged and blocked using the admin API.

Mô tả của NVD

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.