Описание
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | |
| esm-apps/bionic | released | 0.24.0+dfsg-1ubuntu0.1~esm1 |
| esm-apps/focal | not-affected | 1.11.0-1 |
| esm-apps/jammy | not-affected | |
| esm-infra-legacy/trusty | DNE | |
| focal | not-affected | 1.11.0-1 |
| groovy | not-affected | |
| hirsute | not-affected | |
| impish | not-affected |
Показывать по
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.
Matrix Synapse before 1.5.0 mishandles signature checking on some fede ...
Improper Verification of Cryptographic Signature in matrix-synapse
ALT-PU-2020-1099: package `matrix-synapse` update to version 1.8.0-alt1
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3