Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is…
Priority LOW 38CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Why it matters now
EPSS 0.02485 84th percentileScored 2026-11-07
Fix Fixed matrix-synapse (PyPI): 0.34.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | matrix-synapse (PyPI) | before 0.34.0.1 | 0.34.0.1 | Patch available | GHSA-jrqm-v8cv-53ww |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- matrix-synapse (PyPI) Vendor— Affected before 0.34.0.1 Fixed in 0.34.0.1 Patch available GHSA-jrqm-v8cv-53ww
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* | before 0.34.0.1 | Vulnerable | matrix-org |
| cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* | 28 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
- cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 0.34.0.1 Vulnerable ·matrix-org
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-jrqm-v8cv-53ww matrix-synapse (PyPI) Fixed in 0.34.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5885
- 2026-10-03 Alias added: GHSA-jrqm-v8cv-53ww
References
Advisory 3
Other 12
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K/
- https://github.com/matrix-org/synapse/issues/4664
- https://github.com/matrix-org/synapse/pull/4315
- https://github.com/matrix-org/synapse/pull/4373
- https://github.com/matrix-org/synapse
- https://github.com/matrix-org/synapse/blob/67f9e5293ea6650b2ec284c0b7503f3f3eade94b/docs/changelogs/CHANGES-pre-1.0.md?plain=1#L460
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2019-187.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K
- https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1
- https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885
Sources
- CVE-2019-5885 · CVE Program
- CVE-2019-5885 · NVD
- FIRST EPSS
- GHSA-jrqm-v8cv-53ww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences