CVE-2024-53863

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-53863

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53863.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-53863

Aliases

GHSA-vp6v-whfm-rv3g

Related

Published

2024-12-03T17:15:12Z

Modified

2025-03-21T22:47:31.368386Z

Summary

[none]

Details

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP. This vulnerability is fixed in 1.120.1.

References

Affected packages

Debian:13 / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/debian/matrix-synapse?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.121.0-1

Affected versions

0.*

0.19.2+dfsg-3

0.19.2+dfsg-4

0.19.2+dfsg-5

0.19.2+dfsg-6

0.24.0+dfsg-1

0.27.2+dfsg-1

0.28.0+dfsg-1

0.28.0+dfsg-2

0.28.1+dfsg-1

0.29.1+dfsg-1

0.30.0+dfsg-1

0.31.0+dfsg-1

0.31.0+dfsg-2

0.31.1+dfsg-1

0.31.1+dfsg-2

0.31.2+dfsg-1

0.32.2+dfsg-1

0.33.0+dfsg-1

0.33.1+dfsg-1

0.33.2+dfsg-1

0.33.2+dfsg-2

0.33.2+dfsg-3

0.33.3-1

0.33.3-2

0.33.3.1-1

0.33.4-1~bpo9+1

0.33.4-1

0.33.8-1

0.33.9-2~bpo9+1

0.33.9-2

0.34.0~rc2-1

0.34.0-1

0.34.0-2

0.34.0-3~bpo9+1

0.34.0-3~bpo9+2

0.34.0-3

0.34.1.1-1

0.34.1.1-2~bpo9+1

0.34.1.1-2

0.34.1.1-3~bpo9+1

0.34.1.1-3~bpo9+2

0.34.1.1-3

0.34.1.1-4

0.99.0-1~bpo9+1

0.99.0-1~bpo9+2

0.99.0-1~bpo9+3

0.99.0-1

0.99.1.1-1

0.99.2-1~bpo9+1

0.99.2-1~bpo9+2

0.99.2-1

0.99.2-2

0.99.2-3

0.99.2-4

0.99.2-5~bpo9+1

0.99.2-5

0.99.2-6

0.99.3.2-1

0.99.5.1-1

0.99.5.2-1

1.*

1.0.0-1

1.0.0-2~bpo10+1

1.0.0-2

1.1.0-1

1.2.1-1~bpo10+1

1.2.1-1~bpo10+2

1.2.1-1

1.2.1-2

1.3.0-1~bpo10+1

1.3.0-1

1.4.0~rc1-1

1.4.0-1

1.5.0~rc1-1

1.5.0-1

1.5.1-1~bpo10+1

1.5.1-1

1.6.0-1

1.6.1-1~bpo10+1

1.6.1-1

1.7.0-1

1.7.0-2

1.7.1-1

1.7.2-1~bpo10+1

1.7.2-1

1.7.3-1~bpo10+1

1.7.3-1

1.8.0-1

1.9.0-1~bpo10+1

1.9.0-1

1.9.1-1~bpo10+1

1.9.1-1

1.10.0-1

1.10.0-2

1.11.0-1

1.11.1-1~bpo10+1

1.11.1-1

1.12.0-1~bpo10+1

1.12.0-1

1.12.3-1~bpo10+1

1.12.3-1

1.12.4-1~bpo10+1

1.12.4-1

1.13.0-1~bpo10+1

1.13.0-1

1.15.0-1

1.15.1-1~bpo10+1

1.15.1-1~bpo10+2

1.15.1-1

1.15.2-1

1.16.0-1

1.17.0-1~bpo10+1

1.17.0-1

1.18.0-1~bpo10+1

1.18.0-1

1.19.0-1~bpo10+1

1.19.0-1

1.19.1-1~bpo10+1

1.19.1-1~bpo10+2

1.19.1-1~bpo10+3

1.19.1-1

1.19.2-1

1.19.3-1

1.20.0-1

1.20.1-1~bpo10+1

1.20.1-1

1.21.1-1

1.21.2-1~bpo10+1

1.21.2-1

1.22.1-1~bpo10+1

1.22.1-1

1.22.1-2~bpo10+1

1.22.1-2

1.23.0-1~bpo10+1

1.23.0-1

1.24.0-1~bpo10+1

1.24.0-1

1.24.0-2

1.25.0-1~bpo10+1

1.25.0-1

1.25.0-2

1.26.0-1~bpo10+1

1.26.0-1~bpo10+2

1.26.0-1~bpo10+3

1.26.0-1

1.26.0-2

1.26.0-3

1.27.0-1~bpo10+1

1.27.0-1~bpo10+2

1.27.0-1~bpo10+3

1.27.0-1

1.28.0-1~bpo10+1

1.28.0-1~bpo10+2

1.28.0-1

1.29.0-1

1.30.0-1

1.31.0-1

1.31.0-2

1.33.2-1

1.34.0-1

1.35.0-1

1.35.1-1

1.36.0-1

1.37.0-1

1.37.1-1

1.38.0-1

1.38.1-1

1.39.0-1

1.40.0-1~bpo10+1

1.40.0-1~bpo11+1

1.40.0-1

1.41.1-1~bpo10+1

1.41.1-1~bpo11+1

1.41.1-1

1.42.0-1~bpo10+1

1.42.0-1~bpo11+1

1.42.0-1

1.43.0-1~bpo10+1

1.43.0-1~bpo11+1

1.43.0-1

1.44.0-1~bpo10+1

1.44.0-1~bpo11+1

1.44.0-1

1.44.0-2

1.45.0-1

1.45.1-1~bpo10+1

1.45.1-1~bpo11+1

1.45.1-1

1.46.0-1~bpo10+1

1.46.0-1~bpo10+2

1.46.0-1~bpo11+1

1.46.0-1~bpo11+2

1.46.0-1~bpo11+3

1.46.0-1

1.47.0-1

1.47.0-2~bpo10+1

1.47.0-2~bpo11+1

1.47.0-2

1.47.1-1~bpo10+1

1.47.1-1~bpo11+1

1.47.1-1

1.48.0-1~bpo10+1

1.48.0-1~bpo11+1

1.48.0-1

1.49.0-1~bpo10+1

1.49.0-1~bpo10+2

1.49.0-1~bpo10+4

1.49.0-1~bpo11+1

1.49.0-1~bpo11+2

1.49.0-1~bpo11+3

1.49.0-1

1.49.2-1

1.50.0-1

1.50.1-1

1.50.2-1

1.51.0-1~bpo10+1

1.51.0-1~bpo10+2

1.51.0-1~bpo10+3

1.51.0-1~bpo11+1

1.51.0-1~bpo11+2

1.51.0-1

1.52.0-1~bpo10+1

1.52.0-1~bpo11+1

1.52.0-1

1.53.0-1~bpo11+1

1.53.0-1

1.55.0-1~bpo11+1

1.55.0-1

1.55.0-2

1.56.0-1

1.57.1-1~bpo11+1

1.57.1-1

1.59.1-1

1.59.1-2~bpo11+1

1.59.1-2

1.61.0-1~bpo11+1

1.61.0-1~bpo11+2

1.61.0-1~bpo11+3

1.61.0-1

1.61.0-2

1.61.0-3

1.61.1-1

1.63.0-1~bpo11+1

1.63.0-1

1.64.0-1

1.64.0-2

1.64.0-3

1.65.0-1

1.66.0-1~bpo11+1

1.66.0-1

1.66.0-2

1.68.0-1~bpo11+1

1.68.0-1

1.69.0-1~bpo11+1

1.69.0-1

1.70.1-1~bpo11+1

1.70.1-1

1.71.0-1

1.71.0-2~bpo11+1

1.71.0-2

1.72.0-1~bpo11+1

1.72.0-1

1.73.0-1~bpo11+1

1.73.0-1

1.74.0-1~bpo11+1

1.74.0-1~bpo11+2

1.74.0-1

1.77.0-1

1.78.0-1~bpo11+1

1.78.0-1

1.90.0-1

1.91.2-1

1.91.2-2~bpo12+1

1.91.2-2

1.92.0-1

1.92.0-2

1.92.0-3~bpo12+1

1.92.0-3

1.93.0-1

1.94.0-1~bpo12+1

1.94.0-1

1.95.0-1~bpo12+1

1.95.0-1

1.95.1-1~bpo12+1

1.95.1-1

1.97.0-1

1.99.0-1

1.99.0-2

1.99.0-3

1.100.0-1

1.103.0-1

1.103.0-2

1.103.0-3

1.103.0-4

1.103.0-5

1.116.0-1

1.116.0-2

1.116.0-3

1.116.0-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/element-hq/synapse

Affected ranges

Type: GIT
Repo: https://github.com/element-hq/synapse
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

fe3d88b833f76742874642c119b14b788341c905

Affected versions

0.*

0.34.0rc2

1.*

1.7.2

Other

alpha

hhs-1

hhs-2

hhs-3

hhs-4

hhs-5

hhs-6

hhs-7

hhs-8

v0.*

v0.0.0

v0.0.1

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.10.0-r1

v0.10.0-r2

v0.10.0-rc1

v0.10.0-rc2

v0.10.0-rc3

v0.10.0-rc4

v0.10.0-rc5

v0.10.0-rc6

v0.10.1-rc1

v0.11.0

v0.11.0-r1

v0.11.0-r2

v0.11.0-rc1

v0.11.0-rc2

v0.11.1

v0.12.0

v0.12.0-rc1

v0.12.0-rc2

v0.12.0-rc3

v0.12.1-rc1

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.0-rc1

v0.14.0-rc2

v0.15.0-rc1

v0.16.0

v0.16.0-rc1

v0.16.0-rc2

v0.16.1

v0.16.1-r1

v0.16.1-rc1

v0.17.0

v0.17.0-rc1

v0.17.0-rc2

v0.17.0-rc3

v0.17.0-rc4

v0.17.1

v0.17.1-rc1

v0.17.2

v0.17.2-rc1

v0.17.3

v0.18.0

v0.18.0-rc1

v0.18.1

v0.18.1-rc1

v0.18.2

v0.18.2-rc1

v0.18.2-rc2

v0.18.2-rc3

v0.18.2-rc4

v0.18.2-rc5

v0.18.3

v0.18.4

v0.18.4-rc1

v0.18.5

v0.18.5-rc1

v0.18.5-rc2

v0.18.5-rc3

v0.18.6

v0.18.6-rc1

v0.18.6-rc2

v0.18.6-rc3

v0.18.7

v0.18.7-rc1

v0.18.7-rc2

v0.19.0

v0.19.0-rc1

v0.19.0-rc2

v0.19.0-rc3

v0.19.0-rc4

v0.19.1

v0.19.2

v0.19.3

v0.19.3-rc1

v0.19.3-rc2

v0.2.0

v0.2.1

v0.2.1a

v0.2.2

v0.2.3

v0.20.0

v0.20.0-rc1

v0.21.0

v0.21.0-rc1

v0.21.0-rc2

v0.21.0-rc3

v0.21.1

v0.22.0

v0.22.0-rc1

v0.22.0-rc2

v0.22.1

v0.23.0

v0.23.0-rc1

v0.23.0-rc2

v0.23.1

v0.24.0

v0.24.0-rc1

v0.24.1

v0.25.0

v0.25.0-rc1

v0.25.1

v0.26.0

v0.26.0-rc1

v0.26.1

v0.27.0

v0.27.0-rc1

v0.27.0-rc2

v0.27.1

v0.27.2

v0.27.3

v0.27.3-rc1

v0.27.3-rc2

v0.27.4

v0.28.0

v0.28.0-rc1

v0.28.1

v0.29.0

v0.29.0-rc1

v0.29.1

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.30.0

v0.30.0-rc1

v0.31.0

v0.31.0-rc1

v0.31.1

v0.31.2

v0.32.0

v0.32.0rc1

v0.32.1

v0.32.2

v0.33.0

v0.33.0rc1

v0.33.1

v0.33.2

v0.33.2rc1

v0.33.3

v0.33.3.1

v0.33.3rc1

v0.33.3rc2

v0.33.4

v0.33.4rc1

v0.33.4rc2

v0.33.5

v0.33.5.1

v0.33.5rc1

v0.33.6

v0.33.6rc1

v0.33.7

v0.33.7rc1

v0.33.7rc2

v0.33.8

v0.33.8rc1

v0.33.8rc2

v0.33.9

v0.33.9rc1

v0.34.0

v0.34.0rc1

v0.34.0rc2

v0.34.1

v0.34.1+1

v0.34.1.1

v0.34.1rc1

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.3a

v0.5.3b

v0.5.3c

v0.5.4

v0.5.4a

v0.6.0

v0.6.0a

v0.6.0b

v0.6.1

v0.6.1a

v0.6.1b

v0.6.1c

v0.6.1d

v0.6.1e

v0.6.1f

v0.7.0

v0.7.0a

v0.7.0b

v0.7.0c

v0.7.0d

v0.7.0e

v0.7.0f

v0.7.1

v0.7.1-r1

v0.7.1-r2

v0.7.1-r3

v0.7.1-r4

v0.8.0

v0.8.1

v0.8.1-r1

v0.8.1-r2

v0.8.1-r3

v0.8.1-r4

v0.9.0

v0.9.0-r1

v0.9.0-r2

v0.9.0-r3

v0.9.0-r4

v0.9.0-r5

v0.9.1

v0.9.2

v0.9.2-r1

v0.9.2-r2

v0.9.3

v0.9.3-rc1

v0.99.0

v0.99.0rc1

v0.99.0rc2

v0.99.0rc3

v0.99.0rc4

v0.99.1

v0.99.1.1

v0.99.1rc1

v0.99.1rc2

v0.99.2

v0.99.2rc1

v0.99.3

v0.99.3.1

v0.99.3.2

v0.99.3rc1

v0.99.4

v0.99.4rc1

v0.99.5

v0.99.5.1

v0.99.5.1.dev0

v0.99.5.2

v0.99.5rc1

v1.*

v1.0.0

v1.0.0rc1

v1.0.0rc2

v1.0.0rc3

v1.1.0

v1.1.0rc1

v1.1.0rc2

v1.10.0

v1.10.0rc1

v1.10.0rc2

v1.10.0rc3

v1.10.0rc5

v1.10.1

v1.100.0

v1.100.0rc1

v1.100.0rc2

v1.100.0rc3

v1.101.0

v1.101.0rc1

v1.102.0

v1.102.0rc1

v1.103.0

v1.103.0rc1

v1.104.0

v1.104.0rc1

v1.105.0

v1.105.0rc1

v1.105.1

v1.106.0

v1.106.0rc1

v1.107.0

v1.107.0rc1

v1.108.0

v1.108.0rc1

v1.109.0

v1.109.0rc1

v1.109.0rc2

v1.109.0rc3

v1.11.0

v1.11.0rc1

v1.11.1

v1.110.0

v1.110.0rc1

v1.110.0rc2

v1.110.0rc3

v1.111.0

v1.111.0rc1

v1.111.0rc2

v1.111.1

v1.112.0

v1.112.0rc1

v1.113.0

v1.113.0rc1

v1.114.0

v1.114.0rc1

v1.114.0rc2

v1.114.0rc3

v1.115.0

v1.115.0rc1

v1.115.0rc2

v1.116.0

v1.116.0rc1

v1.116.0rc2

v1.117.0

v1.117.0rc1

v1.118.0

v1.118.0rc1

v1.119.0

v1.119.0rc1

v1.119.0rc2

v1.12.0

v1.12.0rc1

v1.12.1

v1.12.1rc1

v1.12.2

v1.12.3

v1.12.4

v1.12.4rc1

v1.120.0

v1.120.0rc1

v1.13.0

v1.13.0rc1

v1.13.0rc2

v1.13.0rc3

v1.14.0

v1.14.0rc1

v1.14.0rc2

v1.15.0

v1.15.0rc1

v1.15.1

v1.15.2

v1.16.0

v1.16.0rc1

v1.16.0rc2

v1.16.1

v1.17.0

v1.17.0rc1

v1.18.0

v1.18.0rc1

v1.18.0rc2

v1.19.0

v1.19.0rc1

v1.19.1

v1.19.1rc1

v1.19.2

v1.19.3

v1.2.0

v1.2.0rc1

v1.2.0rc2

v1.2.1

v1.20.0

v1.20.0rc1

v1.20.0rc2

v1.20.0rc3

v1.20.0rc4

v1.20.0rc5

v1.20.1

v1.21.0

v1.21.0rc1

v1.21.0rc2

v1.21.0rc3

v1.21.1

v1.21.2

v1.22.0

v1.22.0rc1

v1.22.0rc2

v1.22.1

v1.23.0

v1.23.0rc1

v1.23.1

v1.24.0

v1.24.0rc1

v1.24.0rc2

v1.25.0

v1.25.0rc1

v1.26.0

v1.26.0-deb

v1.26.0rc1

v1.26.0rc2

v1.27.0

v1.27.0rc1

v1.27.0rc2

v1.28.0

v1.28.0rc1

v1.29.0

v1.29.0rc1

v1.3.0

v1.3.0rc1

v1.3.1

v1.30.0

v1.30.0rc1

v1.30.1

v1.31.0

v1.31.0rc1

v1.32.0

v1.32.0rc1

v1.32.1

v1.32.2

v1.33.0

v1.33.0rc1

v1.33.0rc2

v1.33.1

v1.33.2

v1.34.0

v1.34.0rc1

v1.35.0

v1.35.0rc1

v1.35.0rc2

v1.35.1

v1.36.0

v1.36.0rc1

v1.36.0rc2

v1.37.0

v1.37.0rc1

v1.37.1

v1.37.1a1

v1.37.1rc1

v1.38.0

v1.38.0rc1

v1.38.0rc2

v1.38.0rc3

v1.38.1

v1.39.0

v1.39.0rc1

v1.39.0rc2

v1.39.0rc3

v1.4.0

v1.4.0rc1

v1.4.0rc2

v1.4.1

v1.4.1rc1

v1.40.0

v1.40.0rc1

v1.40.0rc2

v1.40.0rc3

v1.41.0

v1.41.0rc1

v1.41.1

v1.42.0

v1.42.0rc1

v1.42.0rc2

v1.43.0

v1.43.0rc1

v1.43.0rc2

v1.44.0

v1.44.0rc1

v1.44.0rc2

v1.44.0rc3

v1.45.0

v1.45.0rc1

v1.45.0rc2

v1.45.1

v1.46.0

v1.46.0rc1

v1.47.0

v1.47.0rc1

v1.47.0rc2

v1.47.0rc3

v1.47.1

v1.48.0

v1.48.0rc1

v1.49.0

v1.49.0rc1

v1.49.1

v1.49.2

v1.5.0

v1.5.0rc1

v1.5.0rc2

v1.5.1

v1.50.0

v1.50.0rc1

v1.50.0rc2

v1.50.1

v1.50.2

v1.51.0

v1.51.0rc1

v1.51.0rc2

v1.52.0

v1.52.0rc1

v1.53.0

v1.53.0rc1

v1.54.0

v1.54.0rc1

v1.55.0

v1.55.0rc1

v1.55.1

v1.55.2

v1.56.0

v1.56.0rc1

v1.57.0

v1.57.0rc1

v1.57.1

v1.58.0

v1.58.0rc1

v1.58.0rc2

v1.58.1

v1.59.0

v1.59.0rc1

v1.59.0rc2

v1.59.1

v1.6.0

v1.6.0rc1

v1.6.0rc2

v1.6.1

v1.60.0

v1.60.0rc1

v1.60.0rc2

v1.61.0

v1.61.0rc1

v1.61.1

v1.62.0

v1.62.0rc1

v1.62.0rc2

v1.62.0rc3

v1.63.0

v1.63.0rc1

v1.63.1

v1.64.0

v1.64.0rc1

v1.64.0rc2

v1.65.0

v1.65.0rc1

v1.65.0rc2

v1.66.0

v1.66.0rc1

v1.66.0rc2

v1.67.0

v1.67.0rc1

v1.68.0

v1.68.0rc1

v1.68.0rc2

v1.69.0

v1.69.0rc1

v1.69.0rc2

v1.69.0rc3

v1.69.0rc4

v1.7.0

v1.7.0rc1

v1.7.0rc2

v1.7.1

v1.7.2

v1.7.3

v1.70.0

v1.70.0rc1

v1.70.0rc2

v1.70.1

v1.71.0

v1.71.0rc1

v1.71.0rc2

v1.72.0

v1.72.0rc1

v1.73.0

v1.73.0rc1

v1.73.0rc2

v1.74.0

v1.74.0rc1

v1.75.0

v1.75.0rc1

v1.75.0rc2

v1.76.0

v1.76.0rc1

v1.76.0rc2

v1.77.0

v1.77.0rc1

v1.77.0rc2

v1.78.0

v1.78.0rc1

v1.79.0

v1.79.0rc1

v1.79.0rc2

v1.8.0

v1.8.0rc1

v1.80.0

v1.80.0rc1

v1.80.0rc2

v1.81.0

v1.81.0rc1

v1.81.0rc2

v1.82.0

v1.82.0rc1

v1.83.0

v1.83.0rc1

v1.84.0

v1.84.0rc1

v1.84.1

v1.85.0

v1.85.0rc1

v1.85.0rc2

v1.85.1

v1.85.2

v1.86.0

v1.86.0rc1

v1.86.0rc2

v1.87.0

v1.87.0rc1

v1.88.0

v1.88.0rc1

v1.89.0

v1.89.0rc1

v1.9.0

v1.9.0.dev1

v1.9.0.dev2

v1.9.0rc1

v1.9.1

v1.90.0

v1.90.0rc1

v1.91.0

v1.91.0rc1

v1.91.1

v1.91.2

v1.92.0

v1.92.0rc1

v1.92.1

v1.92.2

v1.92.3

v1.93.0

v1.93.0rc1

v1.94.0

v1.94.0rc1

v1.95.0

v1.95.0rc1

v1.95.1

v1.96.0

v1.96.0rc1

v1.96.1

v1.97.0

v1.97.0rc1

v1.98.0

v1.98.0rc1

v1.99.0

v1.99.0rc1