Vulnerability CVE-2019-5885

Vulnerability Name:

CVE-2019-5885 (CCN-159458)

Assigned:

2019-01-22

Published:

2019-01-22

Updated:

2021-07-21

Summary:

Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-320

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2019-5885

Source: XF
Type: UNKNOWN
matrix-synapse-cve20195885-weak-security(159458)

Source: CCN
Type: Fedora Mailing List, Tuesday, 22 January 2019
[SECURITY] Fedora 29 Update: matrix-synapse-0.34.0.1-1.fc29

Source: CONFIRM
Type: Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ/

Source: CONFIRM
Type: Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K/

Source: CONFIRM
Type: Vendor Advisory
https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/

Source: CONFIRM
Type: Vendor Advisory
https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/

Source: CCN
Type: Matrix Web site
An open network for secure, decentralized communication.

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-5885

Vulnerable Configuration:

Configuration 1:

cpe:/a:matrix:synapse:*:*:*:*:*:*:*:* (Version < 0.34.0.1)

Configuration 2:

cpe:/o:fedoraproject:fedora:28:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:29:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:matrix:synapse:0.33.3:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:112972	P	matrix-synapse-1.43.0-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106421	P	matrix-synapse-1.43.0-1.1 on GA media (Moderate)	2021-10-01
oval:com.ubuntu.bionic:def:20195885000	V	CVE-2019-5885 on Ubuntu 18.04 LTS (bionic) - medium.	2019-03-21
oval:com.ubuntu.disco:def:201958850000000	V	CVE-2019-5885 on Ubuntu 19.04 (disco) - medium.	2019-03-21
oval:com.ubuntu.cosmic:def:20195885000	V	CVE-2019-5885 on Ubuntu 18.10 (cosmic) - medium.	2019-03-21
oval:com.ubuntu.cosmic:def:201958850000000	V	CVE-2019-5885 on Ubuntu 18.10 (cosmic) - medium.	2019-03-21
oval:com.ubuntu.bionic:def:201958850000000	V	CVE-2019-5885 on Ubuntu 18.04 LTS (bionic) - medium.	2019-03-21

BACK