Medium severity · published Oct 10, 2023
CVE-2023-45129
matrix-synapse vulnerable to denial of service due to malicious server ACL events
4.9
CVSS
1.4%
EPSS
No
On KEV
Description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
synapse · matrix-org
< 1.94.0 · source: vendor, NVD
FE
Fedora · Fedoraproject
37; 38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45129
Patch
https://github.com/matrix-org/synapse/pull/16360
Vendor Advisory
https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3/
Release Notes
https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-new-version
More from synapse
7.5
CVE-2022-31152
Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
7.5
CVE-2021-41281
Path traversal in Matrix Synapse
6.5
CVE-2022-39374
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
6.5
CVE-2022-31052
URL previews can crash Synapse media repositories or Synapse monoliths
5.4
CVE-2023-32683
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse