CVE-2022-31152: Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
Impact
The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room.
In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.
Patches
Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.
Workarounds
Federation can be disabled by setting federationdomainwhitelist to an empty list ([]).
References
https://github.com/matrix-org/synapse/pull/13087 https://github.com/matrix-org/synapse/pull/13088
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Other sources
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting federationdomainwhitelist to an empty list ([]) as a workaround.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31152?
CVE-2022-31152 is a vulnerability in Synapse, an open-source Matrix homeserver, which allows attackers to bypass event authorization rules.
What is the severity of CVE-2022-31152?
The severity of CVE-2022-31152 is high, with a severity value of 7.5.
How does CVE-2022-31152 affect Matrix Synapse?
CVE-2022-31152 affects Matrix Synapse versions up to and excluding 1.62.0.
How can I fix CVE-2022-31152?
To fix CVE-2022-31152, it is recommended to update Matrix Synapse to version 1.62.0 or later.
What are the Common Weakness Enumerations (CWEs) associated with CVE-2022-31152?
CVE-2022-31152 is associated with CWE-755 (Improper Handling of Exceptional Conditions) and CWE-703 (Improper Check or Handling of Exceptional Conditions).