GHSA-f3r3-h2mq-hx2h
Synapse allows a a malformed invite to break the invitee's `/sync`
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | matrix-synapse | < 1.120.1 | 1.120.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's `/sync` functionality.
### Patches
Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
### Workarounds
Server administrators can disable federation from untrusted servers.
### For more information
If you have any questions or comments about this advisory, please email us at [security at element.io](mailto:[email protected]).
References
External links from the advisory. They lead to third-party sites.