—
PYSEC-2019-187
Quick fix
PYSEC-2019-187 — matrix-synapse: upgrade to the fixed version with the command below.
pip install --upgrade 'matrix-synapse>=0.34.0.1'Details
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/matrix-synapse
Introduced in:
0Fixed in: 0.34.0.1Fix
pip install --upgrade 'matrix-synapse>=0.34.0.1'References
- https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/[ARTICLE]
- https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/[ARTICLE]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K/[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ/[WEB]
- https://github.com/advisories/GHSA-jrqm-v8cv-53ww[ADVISORY]