Log in Start free

Vulnerability · Published Sep 26, 2023 · Assigned by GitHub_M

CVE-2023-41335Temporary storage of plaintext passwords during password changes in matrix synapse

Low 3.7

In plain English

A low-severity security flaw in synapse from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 67.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20synapse1.93.0-r0ALPINE-CVE-2023-41335
Alpine:v3.21synapse1.93.0-r0ALPINE-CVE-2023-41335
Alpine:v3.22synapse1.93.0-r0ALPINE-CVE-2023-41335
Alpine:v3.23synapse1.93.0-r0ALPINE-CVE-2023-41335
Alpine:v3.24synapse1.93.0-r0ALPINE-CVE-2023-41335
Debian:14matrix-synapse1.93.0-1DEBIAN-CVE-2023-41335
PyPImatrix-synapse1.93.0GHSA-4f74-84v3-j9q5
PyPImatrix-synapse1.93.0PYSEC-2023-185

Affected products (as reported)

VendorProductVersions
matrix-org synapse >= 1.66.0, < 1.93.0

Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

References