Matrix-org Synapse vulnerabilities

• element-hq synapse, fedoraproject fedora +1 more Synapse vulnerable to leak of remote user device information CVE-2023-43796 Fix available 5.3 MediumOctober 31, 2023
• element-hq synapse, fedoraproject fedora +1 more matrix-synapse vulnerable to denial of service due to malicious server ACL events CVE-2023-45129 Fix available 4.9 MediumOctober 10, 2023
• element-hq synapse, fedoraproject fedora +1 more Improper validation of receipts allows forged read receipts in matrix synapse CVE-2023-42453 Fix available 3.1 LowSeptember 26, 2023
• element-hq synapse, fedoraproject fedora +1 more Temporary storage of plaintext passwords during password changes in matrix synapse CVE-2023-41335 Fix available 3.7 LowSeptember 26, 2023
• element-hq synapse URL deny list bypass via oEmbed and image URLs when generating previews in Synapse CVE-2023-32683 Fix available 3.5 LowJune 6, 2023
• element-hq synapse Improper checks for deactivated users during login in synapse CVE-2023-32682 Fix available 5.4 MediumJune 6, 2023
• element-hq synapse Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVE-2023-32323 Fix available 5.0 MediumMay 24, 2023
• element-hq synapse Synapse Denial of service due to incorrect application of event authorization rules during state resolution CVE-2022-39374 Fix available 6.5 MediumMay 24, 2023
• element-hq synapse Synapse does not apply enough checks to servers requesting auth events of events in a room CVE-2022-39335 Fix available 5.0 MediumMay 24, 2023
• element-hq synapse Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules CVE-2022-31152 Fix available 6.4 MediumAugust 31, 2022
• element-hq synapse, fedoraproject fedora +1 more URL previews can crash Synapse media repositories or Synapse monoliths CVE-2022-31052 Fix available 6.5 MediumJune 28, 2022
• element-hq synapse Uncontrolled Resource Consumption in Matrix Synapse CVE-2022-41952 Fix available 6.5 MediumApril 1, 2022
• element-hq synapse, fedoraproject fedora +1 more Path traversal in Matrix Synapse CVE-2021-41281 Fix available 7.5 HighNovember 23, 2021
• element-hq synapse, fedoraproject fedora +1 more Improper authorisation of /members discloses room membership to non-members CVE-2021-39164 Fix available 3.1 LowAugust 31, 2021
• element-hq synapse, fedoraproject fedora +1 more Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. CVE-2021-39163 Fix available 3.1 LowAugust 31, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service in Matrix Synapse CVE-2021-29471 Fix available 3.7 LowMay 11, 2021
• element-hq synapse, fedoraproject fedora +1 more Open redirect via transitional IPv6 addresses on dual-stack networks CVE-2021-21392 Fix available 6.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints CVE-2021-21393 Fix available 5.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints CVE-2021-21394 Fix available 5.3 MediumApril 12, 2021
• element-hq synapse, fedoraproject fedora +1 more HTML injection in email and account expiry notifications CVE-2021-21333 Fix available 6.1 MediumMarch 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Cross-site scripting (XSS) vulnerability in the password reset endpoint CVE-2021-21332 Fix available 6.9 MediumMarch 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Open redirects on some federation and push requests CVE-2021-21273 Fix available 3.1 LowFebruary 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service attack via .well-known lookups CVE-2021-21274 Fix available 4.3 MediumFebruary 26, 2021
• element-hq synapse, fedoraproject fedora +1 more Denial of service attack via incorrect parameters to federation APIs CVE-2020-26257 Fix available 6.5 MediumDecember 9, 2020