CVE-2022-31152

Name of the Vulnerable Software and Affected Versions Synapse versions up to and including 1.61.0

Description The issue arises from the incorrect application of event authorization rules as specified in the Matrix specification, potentially causing divergence in room state between servers. An attacker could craft events that would be accepted by Synapse but not by a spec-conformant server.

Recommendations For Synapse versions up to and including 1.61.0, upgrade to version 1.62.0 or higher. As a temporary workaround, consider disabling federation by setting federation domain whitelist to an empty list ([]).