CVE-2022-31052
2 advisories.
PyPI/matrix-synapse CVE-2022-31052: medium 6.5, EPSS 1.66%
URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
Action: Upgrade matrix-synapse to 1.61.1 or later.
pip install matrix-synapse==1.61.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.61.1 | - |
Fixed versions
| 1.61.1 |
Sources
- osv: GHSA-22p3-qrh9-cx32
- https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32
- https://nvd.nist.gov/vuln/detail/CVE-2022-31052
- https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2022-224.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGSDQ4YAITCUACAB7SXQZDJIU3IQ4CJD
- https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url
CVE-2022-31052 · published · modified · JSON
PyPI/matrix-synapse CVE-2022-31052: unknown, EPSS 1.66%
Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse proce
Action: Upgrade matrix-synapse to 1.61.1 or later.
pip install matrix-synapse==1.61.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.61.1 | - |
Fixed versions
| 1.61.1 |
Sources
- osv: PYSEC-2022-224
- https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32
- https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url
- https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGSDQ4YAITCUACAB7SXQZDJIU3IQ4CJD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF/
CVE-2022-31052 · published · modified · JSON