DEBIAN-CVE-2020-26890
Dashboard / Vulnerabilities / DEBIAN-CVE-2020-26890
Summary:
Details: Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.
Affected packages
Package
Name: matrix-synapse
Purl: pkg:deb/debian/matrix-synapse?arch=source&distro=forky
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -1.20.0-1
Affected versions
0.19.2+dfsg-3
0.19.2+dfsg-4
0.19.2+dfsg-5
0.19.2+dfsg-6
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
