GHSA-4f74-84v3-j9q5 CVE-2023-41335 PYSEC-2023-185
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.39%
- Chance of exploitation in the next 30 days. Higher than 32.79% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
- Fix
1.93.0- Upgrade matrix-synapse to this version or later
Description
Impact
When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.
These temporarily stored passwords are automatically erased after a 48-hour window.
Patches
https://github.com/matrix-org/synapse/pull/16272
References
This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| matrix-synapse | >= 1.66.0, < 1.93.0 |
1.93.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
matrix-synapse PyPI → 1.93.0
- pip
pip install --upgrade "matrix-synapse>=1.93.0"- poetry
poetry add "matrix-synapse>=1.93.0"- uv
uv add "matrix-synapse>=1.93.0"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- None
CVSS 3.1 3.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- High
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
References
Advisories
Packages
Other links
- github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5
- github.com/matrix-org/synapse/pull/13188
- github.com/matrix-org/synapse/pull/16272
- github.com/matrix-org/synapse/commit/69b74d9330e42fc91a9c7423d00a06cd6d3732bf
- github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-185…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4Q…
- security.gentoo.org/glsa/202401-12
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4Q…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6qf2-7x63-mm6v Synapse pagination Denial of Service | Low | Also affects matrix-synapse |
| GHSA-8q93-326v-3m7g Synapse CPU starvation (Denial of Service) | Medium | Also affects matrix-synapse |
| GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality | Medium | Also affects matrix-synapse |
| GHSA-v56r-hwv5-mxg6 Synapse vulnerable to federation denial of service via malformed events | High | Also affects matrix-synapse |
| GHSA-56w4-5538-8v8h Synapse Matrix has a partial room state leak via Sliding Sync | Medium | Also affects matrix-synapse |
| GHSA-vp6v-whfm-rv3g Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders | Critical | Also affects matrix-synapse |
| GHSA-f3r3-h2mq-hx2h Synapse allows a a malformed invite to break the invitee's `/sync` | Medium | Also affects matrix-synapse |
| GHSA-rfq8-j7rh-8hf2 Synapse allows unsupported content types to lead to memory exhaustion | High | Also affects matrix-synapse |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor