The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
References
Link | Resource |
---|---|
https://github.com/matrix-org/synapse/pull/3371 | Patch Third Party Advisory |
https://github.com/matrix-org/synapse/releases/tag/v0.31.1 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-10-03T16:22:07
Updated: 2022-10-03T16:22:07
Reserved: 2022-10-03T00:00:00
Link: CVE-2018-12291
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-06-13T14:29:00.273
Modified: 2019-10-03T00:03:26.223
Link: CVE-2018-12291
JSON object: View
Redhat Information
No data.
CWE