Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A     malicious user on a Synapse homeserver X with permission to create certain state events can disable     outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are     not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of     `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse     1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse     1.74 or newer urgently. (CVE-2023-32323)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A
    malicious user on a Synapse homeserver X with permission to create certain state events can disable
    outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are
    not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of
    `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse
    1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse
    1.74 or newer urgently. (CVE-2023-32323)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0696d7b53 advisory.

    Update matrix-synapse to v1.80.0 to fix CVE-2022-39374, CVE-2023-32323

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
259721	Linux Distros Unpatched Vulnerability : CVE-2023-32323	Nessus	Misc.	medium
414238	SCA: security update for matrix-synapse (GHSA-f3wc-3vxv-xmvr)	Tenable Cloud Security	SCA Checks	medium
414238	SCA: security update for matrix-synapse (GHSA-f3wc-3vxv-xmvr)	Tenable Self-Hosted Container Security	SCA Checks	medium
407308	Alpine: multiple synapse packages: security update to 1.74.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407308	Alpine: multiple synapse packages: security update to 1.74.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
181518	Fedora 37 : matrix-synapse / python-matrix-common / rust-pythonize (2023-c0696d7b53)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-32323

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium