Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in     fields of m.room.member events, allowing remote attackers to execute a denial of service attack against     the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the     impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be     manually redacted instead. Since events are replicated to servers of other room members, the impact is not     constrained to the server of the event sender. (CVE-2020-26890)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in
    fields of m.room.member events, allowing remote attackers to execute a denial of service attack against
    the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the
    impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be
    manually redacted instead. Since events are replicated to servers of other room members, the impact is not
    constrained to the server of the event sender. (CVE-2020-26890)

Update matrix-synapse to 1.23.0 to resolve CVE-2020-26890.

There may be breaking changes, please review prior to upgrade :

https://github.com/matrix-org/synapse/blob/develop/UPGRADE.rst

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257334	Linux Distros Unpatched Vulnerability : CVE-2020-26890	Nessus	Misc.	high
426111	Alpine: multiple synapse packages: security update to 1.20.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426111	Alpine: multiple synapse packages: security update to 1.20.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
410288	SCA: security update for matrix-synapse (GHSA-4mp3-385r-v63f)	Tenable Cloud Security	SCA Checks	high
410288	SCA: security update for matrix-synapse (GHSA-4mp3-385r-v63f)	Tenable Self-Hosted Container Security	SCA Checks	high
144045	Fedora 32 : matrix-synapse / python-authlib / python-canonicaljson / etc (2020-b90dac7fc4)	Nessus	Fedora Local Security Checks	high
144031	Fedora 33 : matrix-synapse / python-canonicaljson (2020-2578d943d2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-26890

high

Tenable Plugins

high

high

high

high

high

high

high