Detections
Analytics
Alpine: multiple synapse packages: security update to 1.70.1-r0
medium Tenable Cloud Security Plugin ID 407307
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The
Matrix Federation API allows remote homeservers to request the authorization events in a room. This is
necessary so that a homeserver receiving some events can validate that those events are legitimate and
permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver
answering a query for authorization events does not sufficiently check that the requesting server should
be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to
upgrade. (CVE-2022-39335)
- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If
Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick
Synapse into accepting previously rejected events into its view of the current state of that room. This
can be exploited in a way that causes all further messages and state changes sent in that room from the
vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0 (CVE-2022-39374)
See Also
Plugin Details
Severity: Medium
ID: 407307
Version: Revision 1.31
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2022-39335
CVSS v3
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.4
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/24/2023
Reference Information
CVE: CVE-2022-39335, CVE-2022-39374