PYSEC-2019-187
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/matrix-synapse/PYSEC-2019-187.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2019-187
- Aliases
- Published
- 2019-03-21T16:01:00Z
- Modified
- 2026-06-10T17:00:58Z
- Summary
- [none]
- Details
-
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
- References
-
- https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/
- https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ/
- https://github.com/advisories/GHSA-jrqm-v8cv-53ww
Affected packages
PyPI / matrix-synapse
Package
- Name
- matrix-synapse
- View open source insights on deps.dev
- Purl
- pkg:pypi/matrix-synapse
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.34.0.1