Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-31152

MEDIUM
Published 2022-09-02T20:00:16.000Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-31152. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
6.4
/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.001
probability
of exploitation in the wild

There is a 0.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.350
Higher than 35.0% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
LOW
Integrity
LOW
Availability
HIGH

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

matrix-org

synapse

Affected Versions:

< 1.62.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Denial of service due to incorrect application of event authorization rules

GHSA-jhjh-776m-4765

Advisory Details

### Impact The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.3/rooms/v10/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. ### Patches Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher. ### Workarounds * Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`). ### References * https://github.com/matrix-org/synapse/pull/13087 * https://github.com/matrix-org/synapse/pull/13088 ### For more information If you have any questions or comments about this advisory, e-mail us at [[email protected]](mailto:[email protected]).

Affected Packages

PyPI matrix-synapse
ECOSYSTEM: ≥0 <1.62.0rc1

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

WEB https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-31152
WEB https://github.com/matrix-org/synapse/pull/13087
WEB https://github.com/matrix-org/synapse/pull/13088
WEB https://github.com/matrix-org/synapse/commit/d4b1c0d800eaa83c4d56a9cf17881ad362b9194b
WEB https://github.com/matrix-org/synapse/commit/e16ea87d0f8c4c30cad36f85488eb1f647e640b0
PACKAGE https://github.com/matrix-org/synapse
WEB https://github.com/matrix-org/synapse/releases/tag/v1.62.0
WEB https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2022-262.yaml

Advisory provided by GitHub Security Advisory Database. Published: August 31, 2022, Modified: September 30, 2024

References

https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765
https://github.com/matrix-org/synapse/pull/13087
https://github.com/matrix-org/synapse/pull/13088
https://github.com/matrix-org/synapse/releases/tag/v1.62.0
Published: 2022-09-02T20:00:16.000Z
Last Modified: 2025-04-23T17:32:15.848Z
Copied to clipboard!