PYSEC-2023-84

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/matrix-synapse/PYSEC-2023-84.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2023-84

Aliases

Published

2023-06-06T19:15:00Z

Modified

2023-11-08T04:12:35.499722Z

Summary

[none]

Details

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the jwt_config.enabled configuration setting. 2. The local password database is enabled via the password_config.enabled and password_config.localdb_enabled configuration settings and a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.

References

Affected packages

PyPI / matrix-synapse

Package

Name: matrix-synapse; View open source insights on deps.dev
Purl: pkg:pypi/matrix-synapse

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.85.0

Affected versions

0.*

0.33.5

0.33.5.1

0.33.6rc1

0.33.6

0.33.7rc1

0.33.7rc2

0.33.7

0.33.8rc2

0.33.8

0.33.9

0.34.0rc1

0.34.0rc2

0.34.0

0.34.0.1

0.34.1.1

0.99.0rc1

0.99.0rc2

0.99.0rc3

0.99.0rc4

0.99.0

0.99.1rc1

0.99.1rc2

0.99.1

0.99.1.1

0.99.2rc1

0.99.2

0.99.3rc1

0.99.3

0.99.3.1

0.99.3.2

0.99.4rc1

0.99.4

0.99.5rc1

0.99.5

0.99.5.1

0.99.5.2

1.*

1.0.0rc1

1.0.0rc2

1.0.0rc3

1.0.0

1.1.0rc1

1.1.0rc2

1.1.0

1.2.0rc1

1.2.0rc2

1.2.0

1.2.1

1.3.0rc1

1.3.0

1.3.1

1.4.0rc1

1.4.0rc2

1.4.0

1.4.1rc1

1.4.1

1.5.0rc1

1.5.0rc2

1.5.0

1.5.1

1.6.0rc1

1.6.0rc2

1.6.0

1.6.1

1.7.0rc1

1.7.0rc2

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0rc1

1.8.0

1.9.0.dev1

1.9.0.dev2

1.9.0rc1

1.9.0

1.9.1

1.10.0rc1

1.10.0rc2

1.10.0rc3

1.10.0rc5

1.10.0

1.10.1

1.11.0rc1

1.11.0

1.11.1

1.12.0rc1

1.12.0

1.12.1rc1

1.12.1

1.12.2

1.12.3

1.12.4rc1

1.12.4

1.13.0rc1

1.13.0rc2

1.13.0rc3

1.13.0

1.14.0rc1

1.14.0rc2

1.14.0

1.15.0rc1

1.15.0

1.15.1

1.15.2

1.16.0rc1

1.16.0rc2

1.16.0

1.16.1

1.17.0rc1

1.17.0

1.18.0rc1

1.18.0rc2

1.18.0

1.19.0rc1

1.19.0

1.19.1rc1

1.19.1

1.19.2

1.19.3

1.20.0rc1

1.20.0rc2

1.20.0rc3

1.20.0rc4

1.20.0rc5

1.20.0

1.20.1

1.21.0rc1

1.21.0rc2

1.21.0rc3

1.21.0

1.21.1

1.21.2

1.22.0rc1

1.22.0rc2

1.22.0

1.22.1

1.23.0rc1

1.23.0

1.23.1

1.24.0rc1

1.24.0rc2

1.24.0

1.25.0rc1

1.25.0

1.26.0rc1

1.26.0rc2

1.26.0

1.27.0rc1

1.27.0rc2

1.27.0

1.28.0rc1

1.28.0

1.29.0rc1

1.29.0

1.30.0rc1

1.30.0

1.30.1

1.31.0rc1

1.31.0

1.32.0rc1

1.32.0

1.32.1

1.32.2

1.33.0rc1

1.33.0rc2

1.33.0

1.33.1

1.33.2

1.34.0rc1

1.34.0

1.35.0rc1

1.35.0rc2

1.35.0rc3

1.35.0

1.35.1

1.36.0rc1

1.36.0rc2

1.36.0

1.37.0rc1

1.37.0

1.37.1rc1

1.37.1

1.38.0rc1

1.38.0rc2

1.38.0rc3

1.38.0

1.38.1

1.39.0rc1

1.39.0rc2

1.39.0rc3

1.39.0

1.40.0rc1

1.40.0rc2

1.40.0rc3

1.40.0

1.41.0rc1

1.41.0

1.41.1

1.42.0rc1

1.42.0rc2

1.42.0

1.43.0rc1

1.43.0rc2

1.43.0

1.44.0rc1

1.44.0rc2

1.44.0rc3

1.44.0

1.45.0rc1

1.45.0rc2

1.45.0

1.45.1

1.46.0rc1

1.46.0

1.47.0rc1

1.47.0rc2

1.47.0rc3

1.47.0

1.47.1

1.48.0rc1

1.48.0

1.49.0rc1

1.49.0

1.49.2

1.50.0rc1

1.50.0rc2

1.50.0

1.50.1

1.50.2

1.51.0rc1

1.51.0rc2

1.51.0

1.52.0rc1

1.52.0

1.53.0rc1

1.53.0

1.54.0rc1

1.54.0

1.55.0rc1

1.55.0

1.55.1

1.55.2

1.56.0rc1

1.56.0

1.57.0rc1

1.57.0

1.57.1

1.58.0rc2

1.58.0

1.58.1

1.59.0rc1

1.59.0rc2

1.59.0

1.59.1

1.60.0rc1

1.60.0rc2

1.60.0

1.61.0rc1

1.61.0

1.61.1

1.62.0rc1

1.62.0rc2

1.62.0rc3

1.62.0

1.63.0rc1

1.63.0

1.63.1

1.64.0rc1

1.64.0rc2

1.64.0

1.65.0rc1

1.65.0rc2

1.65.0

1.66.0rc1

1.66.0rc2

1.66.0

1.67.0rc1

1.67.0

1.68.0rc1

1.68.0rc2

1.68.0

1.69.0rc1

1.69.0rc2

1.69.0rc4

1.69.0

1.70.0rc1

1.70.0rc2

1.70.0

1.70.1

1.71.0rc1

1.71.0rc2

1.71.0

1.72.0rc1

1.72.0

1.73.0rc2

1.73.0

1.74.0rc1

1.74.0

1.75.0rc1

1.75.0rc2

1.75.0

1.76.0rc1

1.76.0rc2

1.76.0

1.77.0rc1

1.77.0rc2

1.77.0

1.78.0rc1

1.78.0

1.79.0rc1

1.79.0rc2

1.79.0

1.80.0rc1

1.80.0rc2

1.80.0

1.81.0rc1

1.81.0rc2

1.81.0

1.82.0rc1

1.82.0

1.83.0rc1

1.83.0

1.84.0rc1

1.84.0

1.84.1

1.85.0rc1

1.85.0rc2