Detections
Analytics

SCA: security update for matrix-synapse (GHSA-jhjh-776m-4765)

high Tenable Cloud Security Plugin ID 416391

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The
 Matrix specification specifies a list of [event authorization
 rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining
 if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0,
 some of these rules are not correctly applied. An attacker could craft events which would be accepted by
 Synapse but not a spec-conformant server, potentially causing divergence in the room state between
 servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or
 higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-
 org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to
 an empty list (`[]`) as a workaround. (CVE-2022-31152)

See Also

https://github.com/advisories/GHSA-jhjh-776m-4765

Plugin Details

Severity: High

ID: 416391

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-31152

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/31/2022

Vulnerability Publication Date: 8/31/2022

Reference Information

CVE: CVE-2022-31152