SB2023100446 - Fedora 37 update for matrix-synapse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023100446

SB2023100446 - Fedora 37 update for matrix-synapse

Published: October 4, 2023

Security Bulletin ID SB2023100446
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Cleartext storage of sensitive information (CVE-ID: CVE-2023-41335)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a user to gain access to sensitive information.

The vulnerability exists due to the way the application handles password change. When users update their passwords, the new credentials may be briefly held in the server database in clear text. A user with access to the database can obtain the password in clear text.


2) Improper access control (CVE-ID: CVE-2023-42453)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can forge read receipts for any event and mark the events as read for other application users.


Remediation

Install update from vendor's website.

References