Fedora 37 : matrix-synapse / python-matrix-common / rust-pythonize (2023-c0696d7b53)

medium Nessus Plugin ID 181518



The remote Fedora host is missing one or more security updates.


The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0696d7b53 advisory.

- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0 (CVE-2022-39374)

- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade. (CVE-2022-39335)

- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently. (CVE-2023-32323)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Update the affected matrix-synapse, python-matrix-common and / or rust-pythonize packages.

See Also


Plugin Details

Severity: Medium

ID: 181518

File Name: fedora_2023-c0696d7b53.nasl

Version: 1.0

Type: local

Agent: unix

Published: 9/18/2023

Updated: 9/18/2023

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment

Risk Information


Risk Factor: Medium

Score: 4.4


Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2022-39335


Risk Factor: Medium

Base Score: 5

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:37, p-cpe:/a:fedoraproject:fedora:matrix-synapse, p-cpe:/a:fedoraproject:fedora:python-matrix-common, p-cpe:/a:fedoraproject:fedora:rust-pythonize

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/9/2023

Vulnerability Publication Date: 5/24/2023

Reference Information

CVE: CVE-2022-39335, CVE-2022-39374, CVE-2023-32323