UBUNTU-CVE-2022-39374

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2022-39374

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-39374.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-39374

Related

Published

2023-05-26T14:15:00Z

Modified

2025-04-23T15:11:05Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

References

Affected packages

Ubuntu:20.04:LTS / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.11.0-1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-1

1.4.0-1

1.5.0-1

1.5.1-1

1.6.0-1

1.6.1-1

1.7.0-2

1.7.1-1

1.7.2-1

1.7.3-1

1.8.0-1

1.9.0-1

1.9.1-1

1.10.0-1

1.10.0-2

1.11.0-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.11.0-1ubuntu0.1~esm2?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-1ubuntu0.1~esm2

Affected versions

1.*

1.3.0-1

1.4.0-1

1.5.0-1

1.5.1-1

1.6.0-1

1.6.1-1

1.7.0-2

1.7.1-1

1.7.2-1

1.7.3-1

1.8.0-1

1.9.0-1

1.9.1-1

1.10.0-1

1.10.0-2

1.11.0-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.11.0-1ubuntu0.1~esm2",
            "binary_name": "matrix-synapse"
        }
    ]
}

Ubuntu:22.04:LTS / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.53.0-1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.39.0-1

1.47.0-2

1.47.1-1

1.48.0-1

1.49.0-1

1.49.2-1

1.50.1-1

1.50.2-1

1.51.0-1

1.52.0-1

1.53.0-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:22.04:LTS / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.53.0-1ubuntu0.1~esm2?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.53.0-1ubuntu0.1~esm2

Affected versions

1.*

1.39.0-1

1.47.0-2

1.47.1-1

1.48.0-1

1.49.0-1

1.49.2-1

1.50.1-1

1.50.2-1

1.51.0-1

1.52.0-1

1.53.0-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.53.0-1ubuntu0.1~esm2",
            "binary_name": "matrix-synapse"
        }
    ]
}

Ubuntu:24.10 / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.100.0-1ubuntu1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.100.0-1ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.100.0-1ubuntu1",
            "binary_name": "matrix-synapse"
        },
        {
            "binary_version": "1.100.0-1ubuntu1",
            "binary_name": "matrix-synapse-dbgsym"
        }
    ]
}

Ubuntu:24.04:LTS / matrix-synapse

Package

Name: matrix-synapse
Purl: pkg:deb/ubuntu/matrix-synapse@1.100.0-1ubuntu1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.100.0-1ubuntu1

Affected versions

1.*

1.90.0-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.100.0-1ubuntu1",
            "binary_name": "matrix-synapse"
        },
        {
            "binary_version": "1.100.0-1ubuntu1",
            "binary_name": "matrix-synapse-dbgsym"
        }
    ]
}