Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The     Matrix specification specifies a list of [event authorization     rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining     if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0,     some of these rules are not correctly applied. An attacker could craft events which would be accepted by     Synapse but not a spec-conformant server, potentially causing divergence in the room state between     servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or     higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-     org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to     an empty list (`[]`) as a workaround. (CVE-2022-31152)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The
    Matrix specification specifies a list of [event authorization
    rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining
    if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0,
    some of these rules are not correctly applied. An attacker could craft events which would be accepted by
    Synapse but not a spec-conformant server, potentially causing divergence in the room state between
    servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or
    higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-
    org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to
    an empty list (`[]`) as a workaround. (CVE-2022-31152)

ID	Name	Product	Family	Severity
251138	Linux Distros Unpatched Vulnerability : CVE-2022-31152	Nessus	Misc.	high
416391	SCA: security update for matrix-synapse (GHSA-jhjh-776m-4765)	Tenable Cloud Security	SCA Checks	high
416391	SCA: security update for matrix-synapse (GHSA-jhjh-776m-4765)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2022-31152

high

Tenable Plugins

high

high

high