pysec-2023-185
Vulnerability from pysec
Published
2023-09-27 15:19
Modified
2023-09-30 05:24
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Details

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

Aliases


To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse",
        "purl": "pkg:pypi/matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.66.0"
            },
            {
              "fixed": "1.93.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.66.0",
        "1.67.0",
        "1.67.0rc1",
        "1.68.0",
        "1.68.0rc1",
        "1.68.0rc2",
        "1.69.0",
        "1.69.0rc1",
        "1.69.0rc2",
        "1.69.0rc4",
        "1.70.0",
        "1.70.0rc1",
        "1.70.0rc2",
        "1.70.1",
        "1.71.0",
        "1.71.0rc1",
        "1.71.0rc2",
        "1.72.0",
        "1.72.0rc1",
        "1.73.0",
        "1.73.0rc2",
        "1.74.0",
        "1.74.0rc1",
        "1.75.0",
        "1.75.0rc1",
        "1.75.0rc2",
        "1.76.0",
        "1.76.0rc1",
        "1.76.0rc2",
        "1.77.0",
        "1.77.0rc1",
        "1.77.0rc2",
        "1.78.0",
        "1.78.0rc1",
        "1.79.0",
        "1.79.0rc1",
        "1.79.0rc2",
        "1.80.0",
        "1.80.0rc1",
        "1.80.0rc2",
        "1.81.0",
        "1.81.0rc1",
        "1.81.0rc2",
        "1.82.0",
        "1.82.0rc1",
        "1.83.0",
        "1.83.0rc1",
        "1.84.0",
        "1.84.0rc1",
        "1.84.1",
        "1.85.0",
        "1.85.0rc1",
        "1.85.0rc2",
        "1.85.1",
        "1.85.2",
        "1.86.0",
        "1.86.0rc2",
        "1.87.0",
        "1.87.0rc1",
        "1.88.0",
        "1.88.0rc1",
        "1.89.0",
        "1.89.0rc1",
        "1.90.0",
        "1.90.0rc1",
        "1.91.0",
        "1.91.0rc1",
        "1.91.1",
        "1.91.2",
        "1.92.0rc1",
        "1.92.1",
        "1.92.2",
        "1.92.3",
        "1.93.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41335",
    "GHSA-4f74-84v3-j9q5"
  ],
  "details": "Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn\u0027t grant the server any added capabilities\u2014it already learns the users\u0027 passwords as part of the authentication process\u2014it does disrupt the expectation that passwords won\u0027t be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.",
  "id": "PYSEC-2023-185",
  "modified": "2023-09-30T05:24:54.158504+00:00",
  "published": "2023-09-27T15:19:00+00:00",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/matrix-org/synapse/pull/16272"
    },
    {
      "type": "FIX",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.