FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-matrix-synapse -- DoS on Federation API

Affected packages
	py36-matrix-synapse	<	1.23.1
	py37-matrix-synapse	<	1.23.1
	py38-matrix-synapse	<	1.23.1
	py39-matrix-synapse	<	1.23.1

Details

VuXML ID	cfa0be42-3cd7-11eb-9de7-641c67a117d8
Discovery	2020-12-09
Entry	2020-12-13

Matrix developers reports:

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /send_join, /send_leave, /invite or /exchange_third_party_invite request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers.

[source]

References

CVE Name	CVE-2020-26257
FreeBSD PR	ports/251768
URL	https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm