Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Summary
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Original description
The description as published by the source.
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of invite_room_state, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized invite_room_state fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-32323 matrix-synapse Fixed in: 1.74.0-1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web lists.fedoraproject.org