Temporary storage of plaintext passwords during password changes in matrix synapse
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.
Summary
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | synapse | 1.66.0 to before 1.93.0 | 1.93.0 | Patch available | CNA |
| — | matrix-synapse (PyPI) | 1.66.0 to before 1.93.0 | 1.93.0 | Patch available | GHSA-4f74-84v3-j9q5 |
- synapse Vendormatrix-org Affected 1.66.0 to before 1.93.0 Fixed in 1.93.0 Patch available CNA
- matrix-synapse (PyPI) Vendor— Affected 1.66.0 to before 1.93.0 Fixed in 1.93.0 Patch available GHSA-4f74-84v3-j9q5
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* | 1.66.0 to before 1.93.0 | Vulnerable | matrix-org |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions 1.66.0 to before 1.93.0 Vulnerable ·matrix-org
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA synapse (matrix-org) Fixed in 1.93.0
- Fix · GHSA-4f74-84v3-j9q5 matrix-synapse (PyPI) Fixed in 1.93.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41335
- 2026-10-03 Alias added: GHSA-4f74-84v3-j9q5
References
Patch 2
Other 11
- https://lists.fedoraproject.org/archives/list/[email protected]/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
- https://security.gentoo.org/glsa/202401-12
- https://github.com/matrix-org/synapse/pull/13188
- https://github.com/matrix-org/synapse/commit/69b74d9330e42fc91a9c7423d00a06cd6d3732bf
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-185.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY
More matrix-org Synapse vulnerabilities
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
- TI-2019-13571 Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. CVSS 3.1CRITICAL 9.8
- TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
- TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
- TI-2018-11846 Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have… CVSS 3.0HIGH 8.8
Sources
- CVE-2023-41335 · CVE Program
- CVE-2023-41335 · NVD
- FIRST EPSS
- GHSA-4f74-84v3-j9q5 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-41335 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences