CVE-2023-45129: matrix-synapse vulnerable to denial of service due to malicious server ACL events
(updated )
A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.
Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.
References
- github.com/advisories/GHSA-5chr-wjw5-3gq4
- github.com/matrix-org/synapse
- github.com/matrix-org/synapse/commit/f84da3c32ec74cf054e2fd6d10618aa4997cffaa
- github.com/matrix-org/synapse/pull/16360
- github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3gq4
- github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-199.yaml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEVRB4MG5UXQ5RLZHSUJXM5GWEBYYS5B
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRO4MPQ6HOXIUZM6RJP6VTCTMV7RD2T3
- matrix-org.github.io/synapse/latest/admin_api/rooms.html
- nvd.nist.gov/vuln/detail/CVE-2023-45129
- security.gentoo.org/glsa/202401-12
Code Behaviors & Features
Detect and mitigate CVE-2023-45129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →