CVE-2023-42453
2 advisories.
PyPI/matrix-synapse CVE-2023-42453: low 3.1
matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
Action: Upgrade matrix-synapse to 1.93.0 or later.
pip install matrix-synapse==1.93.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.34.0 | 1.93.0 | - |
Fixed versions
| 1.93.0 |
Sources
- osv: GHSA-7565-cq32-vx2x
- https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2x
- https://nvd.nist.gov/vuln/detail/CVE-2023-42453
- https://github.com/matrix-org/synapse/pull/16327
- https://github.com/matrix-org/synapse/commit/63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-180.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY
- https://security.gentoo.org/glsa/202401-12
CVE-2023-42453 · published · modified · JSON
PyPI/matrix-synapse CVE-2023-42453: medium 4.3
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that
Action: Upgrade matrix-synapse to 1.93.0 or later.
pip install matrix-synapse==1.93.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.34.0 | 1.93.0 | - |
Fixed versions
| 1.93.0 |
Sources
- osv: PYSEC-2023-180
- https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2x
- https://github.com/matrix-org/synapse/pull/16327
CVE-2023-42453 · published · modified · JSON