ghsa-4f74-84v3-j9q5
Vulnerability from github
Published
2023-09-26 18:55
Modified
2024-09-30 20:42
Severity ?
3.7 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
2.0 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Summary
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
Details

Impact

When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.

These temporarily stored passwords are automatically erased after a 48-hour window.

Patches

https://github.com/matrix-org/synapse/pull/16272

References

This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.66.0"
            },
            {
              "fixed": "1.93.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-26T18:55:24Z",
    "nvd_published_at": "2023-09-27T15:19:30Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nWhen users update their passwords, the new credentials may be briefly held in the server database. While this doesn\u0027t grant the server any added capabilities\u2014it already learns the users\u0027 passwords as part of the authentication process\u2014it does disrupt the expectation that passwords won\u0027t be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.\n\nThese temporarily stored passwords are automatically erased after a 48-hour window.\n\n### Patches\nhttps://github.com/matrix-org/synapse/pull/16272\n\n### References\n\nThis bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.",
  "id": "GHSA-4f74-84v3-j9q5",
  "modified": "2024-09-30T20:42:56Z",
  "published": "2023-09-26T18:55:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41335"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/pull/13188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/pull/16272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/commit/69b74d9330e42fc91a9c7423d00a06cd6d3732bf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/synapse"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-185.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202401-12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.