CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse

What is CVE-2023-42453?

CVE-2023-42453 is a low-severity vulnerability in Fedoraproject Fedora, published on 26 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-285

Which versions are affected by CVE-2023-42453?

3 open source packages ship an affected version, including matrix-synapse. It affects 2 products.

Products include Fedoraproject Fedora, Matrix Synapse.

How do I fix CVE-2023-42453?

Upgrade matrix-synapse to 1.93.0 or later.

Is CVE-2023-42453 being exploited?

There is no known exploitation of CVE-2023-42453 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7565-cq32-vx2x, PYSEC-2023-180, UBUNTU-CVE-2023-42453.