CVE-2018-12291: High severity matrix synapse vulnerability
The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly.
Other sources
The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-12291?
CVE-2018-12291 is a security bug in the get_missing_events federation API in Matrix Synapse before 0.31.1.
What is the severity of CVE-2018-12291?
CVE-2018-12291 has a severity rating of 7.5 (high).
How does CVE-2018-12291 affect Matrix Synapse?
CVE-2018-12291 affects Matrix Synapse versions up to exclusive 0.31.1.
How do I fix CVE-2018-12291?
To fix CVE-2018-12291, update Matrix Synapse to version 0.31.1 or later.
Where can I find more information about CVE-2018-12291?
You can find more information about CVE-2018-12291 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12291), [GitHub Pull Request](https://github.com/matrix-org/synapse/pull/3371), [GitHub Release](https://github.com/matrix-org/synapse/releases/tag/v0.31.1).