Matrix Synapse Predictable Secret Key
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Sep 24, 2024
Description
Published by the National Vulnerability Database
Mar 21, 2019
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 19, 2023
Last updated
Sep 24, 2024
Matrix Synapse before 0.34.0.1, when the
macaroon_secret_key
authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.References