FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-matrix-synapse -- malformed events may prevent users from joining federated rooms

Affected packages
py36-matrix-synapse < 1.19.2
py37-matrix-synapse < 1.19.2
py38-matrix-synapse < 1.19.2

Details

VuXML ID 2327234d-fc4b-11ea-adef-641c67a117d8
Discovery 2020-09-16
Entry 2020-09-21

Problem Description:

Affected Synapse versions assume that all events have an "origin" field set. If an event without the "origin" field is sent into a federated room, servers not already joined to the room will be unable to do so due to failing to fetch the malformed event.

Impact:

An attacker could cause a denial of service by deliberately sending a malformed event into a room, thus preventing new servers (and thus their users) from joining the room.

References

URL https://github.com/matrix-org/synapse/blob/v1.19.3/CHANGES.md
URL https://github.com/matrix-org/synapse/issues/8319
URL https://github.com/matrix-org/synapse/pull/8324