Ubuntu update for matrix-synapse



Risk High
Patch available YES
Number of vulnerabilities 7
CVE-ID CVE-2018-10657
CVE-2018-12291
CVE-2018-12423
CVE-2018-16515
CVE-2019-11842
CVE-2019-18835
CVE-2019-5885
CWE-ID CWE-20
CWE-264
CWE-347
CWE-338
CWE-345
CWE-320
Exploitation vector Network
Public exploit Vulnerability #1 is being exploited in the wild.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

matrix-synapse (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU12518

Risk: Medium

CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2018-10657

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an input validation error where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py. A remote attacker can send malicious messages and perform a denial of service attack.

Note: this vulnerability has been exploited in the wild in April 2018.

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Security restrictions bypass

EUVDB-ID: #VU14207

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12291

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists in the on_get_missing_events function in handlers/federation.py due to event visibility rules were not applied correctly. A remote unauthenticated attacker can bypass security restrictions and conduct further attacks.

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU37030

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-12423

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU76260

Risk: High

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-16515

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exist due to improper signature validation. A remote attacker can spoof application events and compromise the application.

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EUVDB-ID: #VU76258

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-11842

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to usage of a weak algorithm to generate a Sydent authentication token or a Synapse random ID. A remote attacker can brute-force the token and gain unauthorized access to the application.


Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Insufficient verification of data authenticity

EUVDB-ID: #VU22754

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-18835

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to the affected software mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from expected hosts. A remote attacker can compromise the target system

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Key management errors

EUVDB-ID: #VU76259

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-5885

CWE-ID: CWE-320 - Key Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to impersonate application users.

The vulnerability exists due to usage of a weak and predictable secret key if the macaroon_secret_key authentication parameter is not set. A remote attacker can impersonate other application users.

Mitigation

Update the affected package matrix-synapse to the latest version.

Vulnerable software versions

Ubuntu: 18.04

matrix-synapse (Ubuntu package): before Ubuntu Pro

CPE2.3 External links

https://ubuntu.com/security/notices/USN-6076-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###