PyPI/matrix-synapse CVE-2019-18835: high 8.6, EPSS 0.86%

Improper Verification of Cryptographic Signature in matrix-synapse

Action: Upgrade matrix-synapse to 1.5.0 or later.

pip install matrix-synapse==1.5.0

Affected

Fixed versions

Sources

• osv: GHSA-cppw-2mf8-qpm5
• https://nvd.nist.gov/vuln/detail/CVE-2019-18835
• https://github.com/matrix-org/synapse/pull/6262
• https://github.com/matrix-org/synapse/commit/172f264ed38e8bef857552f93114b4ee113a880b
• https://github.com/matrix-org/synapse
• https://github.com/matrix-org/synapse/releases/tag/v1.5.0
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2019-186.yaml

CVE-2019-18835 · published 2022-05-24T22:01:05Z · modified 2025-02-15T05:30:05.833872Z · JSON