Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
概要
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of invite_room_state, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized invite_room_state fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-32323 matrix-synapse 修正版: 1.74.0-1
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web lists.fedoraproject.org