SB2023100445 - Fedora 38 update for matrix-synapse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023100445

SB2023100445 - Fedora 38 update for matrix-synapse

Published: October 4, 2023

Security Bulletin ID SB2023100445
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cleartext storage of sensitive information (CVE-ID: CVE-2023-41335)

The vulnerability allows a user to gain access to sensitive information.

The vulnerability exists due to the way the application handles password change. When users update their passwords, the new credentials may be briefly held in the server database in clear text. A user with access to the database can obtain the password in clear text.


2) Improper access control (CVE-ID: CVE-2023-42453)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can forge read receipts for any event and mark the events as read for other application users.


Remediation

Install update from vendor's website.

References