GitStock

matrix-org/synapse · Security

matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes

GHSA ID
GHSA-4f74-84v3-j9q5
CVE ID
CVE-2023-41335
Severity
low
Published
Updated
CVSS
3.7 · CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v3
3.7 · CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4
2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Description

Impact

When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.

These temporarily stored passwords are automatically erased after a 48-hour window.

Patches

https://github.com/matrix-org/synapse/pull/16272

References

This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.

CWEs

  • CWE-312 · Cleartext Storage of Sensitive Information

References