SB20250422198 - Ubuntu update for matrix-synapse
Published: April 22, 2025 Updated: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2023-32683)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input within the oEmbed and image URLs. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
2) Improper access control (CVE-ID: CVE-2023-43796)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in cached remote user device information handling when querying device information. A remote attacker can query cached device information of remote users to disclose sensitive information.
This can be used to enumerate remote users known to the homeserver.
3) Incorrect authorization (CVE-ID: CVE-2022-39374)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper authorization in event authorization rules during state resolution when processing room state from a joined malicious homeserver. A remote user can trick Synapse into accepting previously rejected events to cause a denial of service.
Exploitation is possible only when the homeserver is joined to rooms that include or invite members of untrusted homeservers.
4) Cleartext storage of sensitive information (CVE-ID: CVE-2023-41335)
CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a user to gain access to sensitive information.
The vulnerability exists due to the way the application handles password change. When users update their passwords, the new credentials may be briefly held in the server database in clear text. A user with access to the database can obtain the password in clear text.
5) Information disclosure (CVE-ID: CVE-2022-39335)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Matrix Federation API. A remote homeservers can request the authorization events in a room
6) Improper access control (CVE-ID: CVE-2023-42453)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can forge read receipts for any event and mark the events as read for other application users.
7) Incorrect calculation (CVE-ID: CVE-2024-31208)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper calculation of the auth chain cover index in auth chain indexing when processing specially crafted events from a remote room member. A remote user can send specially crafted events to cause a denial of service.
Exploitation can lead to disk fill and high CPU usage. Servers in private federations, or those that do not federate, are not affected.
8) Interpretation Conflict (CVE-ID: CVE-2024-53863)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to invoke potentially untrustworthy decoders.
The vulnerability exists due to improper restriction of processed file formats in thumbnail generation when processing a specially crafted request. A remote attacker can send a specially crafted request to invoke potentially untrustworthy decoders.
Instances with the dynamic_thumbnails option enabled are affected.
Remediation
Install update from vendor's website.