Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
45 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
Recommended action: Upgrade to 0.33.3.1 or 0.33.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force.
Recommended action: Upgrade to 0.31.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly.
Recommended action: Upgrade to 0.31.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix Synapse before 0.34.0.1, when the macaroonsecretkey authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Recommended action: Upgrade to 0.34.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Patches 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. We recommend upgrading to 1.53.0 to fully resolve the issue. Workarounds Turn off URL preview functionality by…
Recommended action: Upgrade to 1.53.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected. Patches Server administrators should upgrade to 1.47.1 or later. Workarounds Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints: /matrix/media/r0/download/{serverName}/{mediaId} /matrix/media/r0/download/{serverName}/{mediaId}/{fileName} /matrix/media/r0/thumbnail/{serverName}/{mediaId} Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at contrib/systemd/override-hardened.conf.…
Recommended action: Upgrade to 1.47.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where: - the vulnerable homeserver is in the room; and - untrusted users are permitted to create groups (communities). By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting enablegroupcreation has been set to true are impacted. Patches Server administrators should upgrade to 1.41.1 or higher. Workarounds Server administrators can set enablegroupcreation to false in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could, with partial loss of group functionality, block the following endpoints: /matrix/client/r0/groups/{groupid}/rooms…
Recommended action: Upgrade to 1.41.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Patches Server administrators should upgrade to 1.41.1 or later. Workarounds Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints: /matrix/client/r0/rooms/{roomid}/members with at query parameter /matrix/client/unstable/rooms/{roomid}/members with at query parameter References n/a For more information If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Recommended action: Upgrade to 1.41.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Patches The issue is fixed by https://github.com/matrix-org/synapse/pull/9855. Workarounds There are no known workarounds. References n/a For more information If you have any questions or comments about this advisory, email us at security@matrix.org.
Recommended action: Upgrade to 1.33.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact "Push rules" can specify conditions under which they will match, including eventmatch, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. Patches The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c. Workarounds A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. For more information If you have any questions or comments about this advisory, email us at security@matrix.org.
Recommended action: Upgrade to 1.33.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. Patches This issue is fixed by #9240. Workarounds Outbound requests to the following address ranges can be blocked by a firewall, if unused for internal communication between systems: ::ffff/80 ::0000/80 (note that this IP range is considered deprecated by the IETF) 2002::/16 (note that this IP range is considered deprecated by the IETF) References RFC3056 RFC4291
Recommended action: Upgrade to 1.28.0rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Patches The issue is fixed by #9321. Workarounds Depending on the needs and configuration of the homeserver a few options are available: 1. Using email as third-party identifiers be disabled by not configuring the email setting. 2. Using phone numbers as third-party identifiers can be disabled by ensuring that accountthreepiddelegates.msisdn is not configured. 3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy: ^/matrix/client/(r0|unstable)/register/email ^/matrix/client/(r0|unstable)/register/msisdn ^/matrix/client/(r0|unstable)/account/password ^/matrix/client/(r0|unstable)/account/3pid
Recommended action: Upgrade to 1.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields. Patches This issue is fixed by #9321 and #9393. Workarounds The groups feature can be disabled (by setting enablegroupcreation to False) to mitigate this issue. Note that it is disabled by default. Other information Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
Recommended action: Upgrade to 1.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. Patches This issue is fixed in #9200. Workarounds For the missed messages notifications: The notif.html, notifmail.html, and room.html templates can be overridden with custom templates that manually escapes the variables using JInja2's escape filter. See the email.templatedir setting. For the account expiry notifications: 1. Account expiry can be disabled via the accountvalidity.enabled setting. 2. The noticeexpiry.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.templatedir setting.
Recommended action: Upgrade to 1.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. Patches This is fixed in #9200. Workarounds Depending on the needs and configuration of the homeserver a few options are available: 1. Password resets can be disabled by delegating email to a third-party service (via the accountthreepiddelegates.email setting) or disabling email (by not configuring the email setting). 2. If the homeserver is not configured to use passwords (via the passwordconfig.enabled setting) then the affected endpoint can be blocked at a reverse proxy: /synapse/client/passwordreset/email/submittoken 3. The passwordresetconfirmation.html template can be overridden with a custom template that manually escapes the variables…
Recommended action: Upgrade to 1.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Patches Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108. Workarounds The federationdomainwhitelist setting can be used to restrict the homeservers communicated with over federation.
Recommended action: Upgrade to 1.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated federationiprangeblacklist from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new iprangeblacklist and iprangewhitelist settings if more specific control is necessary. Patches Issue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954. Workarounds Requests to internal IP addresses could be blocked at the system or network level.
Recommended action: Upgrade to 1.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /sendjoin, /sendleave, /invite or /exchangethirdpartyinvite request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. Patches Issue is resolved by https://github.com/matrix-org/synapse/pull/8776. Workarounds Homeserver administrators could limit access to the federation API to trusted servers (for example via federationdomainwhitelist).
Recommended action: Upgrade to 1.23.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state. Patches At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks. Workarounds There are no known workarounds. Upgrading notes If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.
Recommended action: Upgrade to 1.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. Patches This is fixed by #8444, which is included in Synapse v1.21.0. Workarounds If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy: /matrix/client/r0/auth/./fallback/web /matrix/client/unstable/auth/./fallback/web
Recommended action: Upgrade to 1.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.