CVE-2022-39374

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-39374
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/matrix-org/synapse/pull/13723 Issue Tracking Patch
https://github.com/matrix-org/synapse/pull/13723 Issue Tracking Patch
https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 Mitigation Vendor Advisory
https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 Mitigation Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:15

Type Values Removed Values Added
Summary Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0 Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/ -
References (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 - Mitigation, Vendor Advisory () https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 - Mitigation, Vendor Advisory
References (MISC) https://github.com/matrix-org/synapse/pull/13723 - Issue Tracking, Patch () https://github.com/matrix-org/synapse/pull/13723 - Issue Tracking, Patch

02 Jun 2023, 14:41

Type Values Removed Values Added
First Time Matrix synapse
Matrix
CWE CWE-400
References (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 - (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7 - Mitigation, Vendor Advisory
References (MISC) https://github.com/matrix-org/synapse/pull/13723 - (MISC) https://github.com/matrix-org/synapse/pull/13723 - Issue Tracking, Patch
CPE cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

26 May 2023, 15:56

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-26 14:15

Updated : 2025-02-13 17:15

NVD link : CVE-2022-39374

Mitre link : CVE-2022-39374

JSON object : View

Products Affected

matrix

  • synapse
CWE
CWE-400

Uncontrolled Resource Consumption