Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Résumé
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of invite_room_state, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized invite_room_state fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-32323 matrix-synapse Corrigé dans: 1.74.0-1
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web lists.fedoraproject.org