Richvdh

The issue arises from the failure to correctly validate the sender of an encrypted event in the matrix-sdk-crypto component. This allows a malicious homeserver operator to modify events served to clients, making those events appear to the recipient as if they were sent by another user.

The issue arises from the incorrect application of event authorization rules as specified in the Matrix specification, potentially causing divergence in room state between servers. An attacker could craft events that would be accepted by Synapse but not by a spec-conformant server.

Name of the Vulnerable Software and Affected Versions: Sydent versions prior to the versions including fixes 9e57334, 8936925, 3d531ed, 0f00412 Description: The issue allows Sydent to be induced to send HTTP GET requests to internal systems due to a lack of parameter validation or IP address blacklisting. Although it is not possible to exfiltrate data or control request headers, the attack might be used to perform an internal port enumeration. Recommendations: For versions prior to the fixed versions, update to a version that includes the fixes 9e57334, 8936925, 3d531ed, 0f00412 to resolve the issue. As a temporary workaround, consider configuring a firewall to prevent Sydent from reaching internal HTTP resources.

Name of the Vulnerable Software and Affected Versions: Sydent versions prior to 89071a1, 0523511, f56eee3 Description: Sydent is a reference Matrix identity server that does not limit the size of requests it receives from HTTP clients, allowing a malicious user to send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Additionally, Sydent does not limit response size for requests it makes to remote Matrix homeservers, which could lead to memory exhaustion and denial of service if a malicious homeserver returns a very large response. This issue affects any server that accepts registration requests from untrusted clients. Recommendations: For versions prior to 89071a1, 0523511, f56eee3, update to one of these releases to resolve the issue. As a temporary workaround, consider limiting request sizes in an HTTP reverse-proxy to minimize the risk of exploitation. Note: There are no known workarounds for the problem with overlarge responses from remote Matrix homeservers.

Name of the Vulnerable Software and Affected Versions: Sydent versions prior to 4469d1d Description: A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address, potentially constructing plausible phishing emails. Recommendations: For versions prior to 4469d1d, update to a version that includes the fixes, such as 4469d1d, 6b405a8, or 65a6e91. Note that if the default email templates have been locally modified, they must also be updated to prevent exploitation. As a temporary workaround, consider restricting access to the email functionality in Sydent until the update can be applied.

Name of the Vulnerable Software and Affected Versions: Sydent versions 2.2.0 and prior Description: The issue is related to missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could cause excessive use of disk space and memory leading to resource exhaustion. Recommendations: For Sydent versions 2.2.0 and prior, update to version 2.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the endpoints used to confirm third-party identifiers until a patch is applied. Avoid using parameters that are not properly validated on these endpoints until the issue is resolved.

The issue is related to uncontrolled resource consumption in Synapse's push rules. It allows a remote attacker to cause a denial-of-service. The problem arises when certain patterns, including wildcards, are used in the `event match` condition, leading to poor performance in the matching engine when processing moderate length events.

The issue is related to missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could cause excessive use of disk space and memory leading to resource exhaustion. This affects the groups feature, also known as communities, which is not part of the Matrix specification. The chosen maximum lengths are arbitrary, and not all clients might abide by them.

The issue affects Synapse, a Matrix reference homeserver written in python, where requests to user-provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. This could cause Synapse to make requests to internal infrastructure on dual-stack networks, affecting outbound requests to federation, identity servers, key validity calculations for third-party invite events, push notifications, and URL previews.

The issue is caused by missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could lead to excessive use of disk space and memory, resulting in resource exhaustion. The affected endpoints include "/ matrix/client/(r0|unstable)/register/email", "/ matrix/client/(r0|unstable)/register/msisdn", "/ matrix/client/(r0|unstable)/account/password", and "/ matrix/client/(r0|unstable)/account/3pid".

The issue allows remote attackers to spoof events and possibly have other impacts by leveraging improper transaction and event signature validation.