Detections
Analytics
Alpine: multiple synapse packages: security update to 1.110.0-r0
high Tenable Cloud Security Plugin ID 426248
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill
attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of
remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial
of service, ranging from further media uploads/downloads failing to completely unavailability of the
Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate
limit on remote media downloads to reduce the amount of data a user can request at a time. This does not
fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data
to be cached. (CVE-2024-37302)
- Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design,
unauthenticated remote participants to trigger a download and caching of remote media from a remote
homeserver to the local media repository. Such content then also becomes available for download from the
local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can
use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a
partial mitigation in the form of new endpoints which require authentication for media downloads. The
unauthenticated endpoints will be frozen in a future release, closing the attack vector. (CVE-2024-37303)
See Also
Plugin Details
Severity: High
ID: 426248
Version: Revision 1.5
Type: Local
Published: 5/16/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2024-37303
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2024-37302
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/3/2024
Reference Information
CVE: CVE-2024-37302, CVE-2024-37303