SB2023090940 - Fedora 37 update for matrix-synapse, python-matrix-common, rust-pythonize
Published: September 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect authorization (CVE-ID: CVE-2022-39374)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper authorization in event authorization rules during state resolution when processing room state from a joined malicious homeserver. A remote user can trick Synapse into accepting previously rejected events to cause a denial of service.
Exploitation is possible only when the homeserver is joined to rooms that include or invite members of untrusted homeservers.
2) Input validation error (CVE-ID: CVE-2023-32323)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in invite_room_state handling when processing room invites. A remote user can create an oversized invite event to cause a denial of service.
Only Synapse instances with federation enabled are affected, and exploitation requires permission to create certain state events.
3) Information disclosure (CVE-ID: CVE-2022-39335)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Matrix Federation API. A remote homeservers can request the authorization events in a room
Remediation
Install update from vendor's website.