synapse vulnerabilities (Alpine)
29 vulnerabilities.
-
synapseAlpine ESS Community Helm Chart has a weak server key generation method 9.2 Critical -
synapseAlpine Synapse: Invalid device keys degrade federation functionality 5.3 Medium -
synapseAlpine The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution... 7.1 High -
synapseAlpine Synapse vulnerable to federation denial of service via malformed events 7.1 High -
synapseAlpine Synapse unauthenticated writes to the media repository allow planting of problematic content 5.3 Medium -
synapseAlpine Synapse denial of service through media disk space consumption 7.5 High -
synapseAlpine Synapse allows unsupported content types to lead to memory exhaustion 8.2 High -
synapseAlpine Synapse allows a a malformed invite to break the invitee's `/sync` 8.7 High -
synapseAlpine Synapse Matrix has a partial room state leak via Sliding Sync 4.3 Medium -
synapseAlpine Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders 8.2 High -
synapseAlpine twisted.web has disordered HTTP pipeline response 8.3 High -
synapseAlpine Synapse vulnerable to leak of remote user device information 5.3 Medium -
synapseAlpine matrix-synapse vulnerable to denial of service due to malicious server ACL events 4.9 Medium -
synapseAlpine Improper validation of receipts allows forged read receipts in matrix synapse 3.1 Low -
synapseAlpine Temporary storage of plaintext passwords during password changes in matrix synapse 3.7 Low -
synapseAlpine URL deny list bypass via oEmbed and image URLs when generating previews in Synapse 3.5 Low -
synapseAlpine Improper checks for deactivated users during login in synapse 5.4 Medium -
synapseAlpine Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites 5.0 Medium -
synapseAlpine Synapse Denial of service due to incorrect application of event authorization rules during state resolution 6.5 Medium -
synapseAlpine Synapse does not apply enough checks to servers requesting auth events of events in a room 5.0 Medium -
synapseAlpine URL previews can crash Synapse media repositories or Synapse monoliths 6.5 Medium -
synapseAlpine Path traversal in Matrix Synapse 7.5 High -
synapseAlpine Improper authorisation of /members discloses room membership to non-members 3.1 Low -
synapseAlpine Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. 3.1 Low -
synapseAlpine Denial of service in Matrix Synapse 3.7 Low -
synapseAlpine NULL pointer deref in signature_algorithms processing 5.9 Medium -
synapseAlpine Denial of service attack via incorrect parameters to federation APIs 6.5 Medium -
synapseAlpine Denial of service attack due to invalid JSON 7.5 High -
synapseAlpine Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint 6.1 Medium