{"id":"CVE-2019-18835","published":"2019-11-07T23:12:07Z","modified":"2024-08-05T02:02:39Z","title":"Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs","vendor":null,"product":null,"tier":"tail","description":{"text":"Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00864,"percentile":0.586,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/matrix-org/synapse/pull/6262","tags":["x_refsource_MISC"]},{"url":"https://github.com/matrix-org/synapse/releases/tag/v1.5.0","tags":["x_refsource_MISC"]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":11.72}]},"affected":[{"ecosystem":"PyPI","package":"matrix-synapse","vulnerableRanges":["<1.5.0"],"patched":["1.5.0"],"from":["GHSA-cppw-2mf8-qpm5","PYSEC-2019-186"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0083","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-matrix-org-synapse-cve-2019-18835","children":[{"from":"CVE-2019-18835","to":"CVE-2020-26257","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["synapse/federation/federation_server.py","synapse/handlers/federation.py"],"commits":["https://github.com/matrix-org/synapse/commit/172f264ed38e8bef857552f93114b4ee113a880b","https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b"],"basis":"shared function","functions":["on_invite_request"]},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-16515","published":"2018-09-18","fixed":"0.33.3.1","kev":false},{"cve":"CVE-2019-5885","published":"2019-03-19","fixed":"0.34.0.1","kev":false},{"cve":"CVE-2019-11842","published":"2019-05-09","fixed":"0.99.3.1","kev":false},{"cve":"CVE-2019-18835","published":"2019-11-07","fixed":"1.5.0","kev":false},{"cve":"CVE-2020-26890","published":"2020-11-24","fixed":"1.20.0","kev":false,"link":{"from":"CVE-2019-18835","to":"CVE-2020-26890","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:matrix-synapse","fromFixed":"1.5.0","toFixed":"1.20.0","daysApart":383}]}},{"cve":"CVE-2020-26891","published":"2020-10-19","fixed":"1.21.0","kev":false},{"cve":"CVE-2020-26257","published":"2020-12-09","fixed":"1.23.1","kev":false}],"package":"PyPI:matrix-synapse"}}