Detections
Analytics

Alpine: multiple synapse packages: security update to 1.61.1-r0

high Tenable Self-Hosted Container Security Plugin ID 426994

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Synapse is an open source home server implementation for the Matrix chat network. In versions prior to
 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to
 unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the
 problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this
 maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local
 user's client may automatically request a URL preview for. Remote users are not able to exploit this
 directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false`
 set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration
 **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected,
 because the default is `false`. Administrators of homeservers with URL previews enabled are advised to
 upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.
 (CVE-2022-31052)

See Also

https://security.alpinelinux.org/vuln/CVE-2022-31052

Plugin Details

Severity: High

ID: 426994

Version: Revision 1.5

Type: Local

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2022-31052

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/28/2022

Reference Information

CVE: CVE-2022-31052