⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2018-10657 — Improper Input Validation in Synapse
Severity
7.5HIGHNVD
EPSS
0.4%
top 37.13%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMay 2
Latest updateMay 16
Description
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages1 packages
Patches
🔴Vulnerability Details
6📋Vendor Advisories
2💬Community
2Bugzilla▶
CVE-2018-10657 matrix-synapse: Injection of malicious events with a depth size of 2^63-1 can cause a denial of service to making rooms unusable [fedora-all]↗2018-05-04
Bugzilla▶
CVE-2018-10657 matrix-synapse: Injection of malicious events with a depth size of 2^63-1 can cause a denial of service to making rooms unusable↗2018-05-04