Patchfirst
Patchfirst
Chainmatrix-org · synapsePyPI:matrix-synapse

matrix-org synapse: related fixes (2019–2021)

8 CVEs over 4 generations, 7 Nov 2019 to 23 Nov 2021.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2019-188357 Nov 2019 First in the chain
  2. CVE-2020-262579 Dec 2020 related to CVE-2019-18835
  3. CVE-2021-2127326 Feb 2021 next fix after CVE-2020-26257
  4. CVE-2021-2127426 Feb 2021 next fix after CVE-2020-26257related to CVE-2021-21273
  5. CVE-2021-2139312 Apr 2021 related to CVE-2020-26257related to CVE-2021-21273
  6. CVE-2021-3916331 Aug 2021 related to CVE-2021-21393
  7. CVE-2021-3916431 Aug 2021 related to CVE-2021-21393
  8. CVE-2021-4128123 Nov 2021 related to CVE-2021-21393next fix after CVE-2021-39164
Nov 2019Apr 2020OctJan 2021AprJulOct CVE-2020-26257 → CVE-2021-21273: Next fix in the same package (high confidence)CVE-2019-18835 → CVE-2020-26257: related (medium confidence)CVE-2020-26257 → CVE-2021-21274: Next fix in the same package (medium confidence)CVE-2020-26257 → CVE-2021-21393: related (medium confidence)CVE-2021-21273 → CVE-2021-21274: related (medium confidence)CVE-2021-21273 → CVE-2021-21393: related (medium confidence)CVE-2021-21393 → CVE-2021-39163: related (medium confidence)CVE-2021-21393 → CVE-2021-39164: related (medium confidence)CVE-2021-21393 → CVE-2021-41281: related (medium confidence)CVE-2021-39164 → CVE-2021-41281: Next fix in the same package (low confidence) CVE-2019-18835 7 Nov 2019 CVE-2020-26257 9 Dec 2020 CVE-2021-21273 26 Feb 2021 CVE-2021-21274 26 Feb 2021 CVE-2021-21393 12 Apr 2021 CVE-2021-39163 31 Aug 2021 CVE-2021-39164 31 Aug 2021 CVE-2021-41281 23 Nov 2021 Nov 2019Apr 2020JulOctJan 2021AprJulOct CVE-2020-26257 → CVE-2021-21273: Next fix in the same package (high confidence)CVE-2019-18835 → CVE-2020-26257: related (medium confidence)CVE-2020-26257 → CVE-2021-21274: Next fix in the same package (medium confidence)CVE-2020-26257 → CVE-2021-21393: related (medium confidence)CVE-2021-21273 → CVE-2021-21274: related (medium confidence)CVE-2021-21273 → CVE-2021-21393: related (medium confidence)CVE-2021-21393 → CVE-2021-39163: related (medium confidence)CVE-2021-21393 → CVE-2021-39164: related (medium confidence)CVE-2021-21393 → CVE-2021-41281: related (medium confidence)CVE-2021-39164 → CVE-2021-41281: Next fix in the same package (low confidence) CVE-2019-18835 7 Nov 2019 CVE-2020-26257 9 Dec 2020 CVE-2021-21273 26 Feb 2021 CVE-2021-21274 26 Feb 2021 CVE-2021-21393 12 Apr 2021 CVE-2021-39163 31 Aug 2021 CVE-2021-39164 31 Aug 2021 CVE-2021-41281 23 Nov 2021
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2019-18835 7 Nov 2019 Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs · fixed in 1.5.0 First in chain 11.7
CVE-2020-26257 9 Dec 2020 Denial of service attack via incorrect parameters to federation APIs · fixed in 1.23.1 CVE-2019-18835 · related · Medium 21.3
CVE-2021-21273 26 Feb 2021 Open redirects on some federation and push requests · fixed in 1.25.0 CVE-2020-26257 · Next fix in the same package · High 17.9
CVE-2021-21274 26 Feb 2021 Denial of service attack via .well-known lookups · fixed in 1.25.0 CVE-2020-26257 · Next fix in the same package · Medium 19.5
CVE-2021-21393 12 Apr 2021 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints · fixed in 1.28.0 CVE-2020-26257 · related · Medium 18.9
CVE-2021-39163 31 Aug 2021 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. · fixed in 1.41.1 CVE-2021-21393 · related · Medium 14.1
CVE-2021-39164 31 Aug 2021 Improper authorisation of /members discloses room membership to non-members · fixed in 1.41.1 CVE-2021-21393 · related · Medium 16.8
CVE-2021-41281 23 Nov 2021 Path traversal in Matrix Synapse · fixed in 1.47.1 CVE-2021-21393 · related · Medium 20.3
↑ ↓ chooseEnter openEsc close