There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between
    1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events,
    like messages, are unaffected. This vulnerability is fixed in 1.120.1. (CVE-2024-53867)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can
    in certain configurations transiently increase memory consumption beyond expected levels while processing
    the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by
    denying requests with unsupported multipart/form-data content type. (CVE-2024-52805)

  - Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate
    invites received over federation. This vulnerability allows a malicious server to send a specially crafted
    invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites
    received over federation and restores the ability to sync for affected users. (CVE-2024-52815)

  - Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the
    dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and
    thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for
    processing. This significantly expands the attack surface in a historically vulnerable area, presenting a
    risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or
    within the Matrix ecosystem. Synapse 1.120.1 addresses the issue by restricting thumbnail generation to
    images in the following widely used formats: PNG, JPEG, GIF, and WebP. This vulnerability is fixed in
    1.120.1. (CVE-2024-53863)

  - Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between
    1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events,
    like messages, are unaffected. This vulnerability is fixed in 1.120.1. (CVE-2024-53867)

リモートの Fedora 41 ホストには、FEDORA-2024-4cadba7a29 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    CVE-2024-52805、CVE-2024-52815、CVE-2024-53863、CVE-2024-53867

    ----

    v1.120.1 からのバックポート修正

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、71f3e9f0-bafc-11ef-885d-901b0e934d69 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    element-hq/synapse 開発者による報告:
    [1.120.1] リリースでは、複数のセキュリティの脆弱性を修正しています。一部の脆弱性は、以前のすべてのバージョンの Synapse に影響を与えています。サーバー管理者は、ただちに Synapse を更新することが推奨されています。弊社は、これらの脆弱性が野放しで悪用されているとは認識していません。
    Synapse を更新できない管理者は、以下にリンクされている GitHub セキュリティアドバイザリで説明されている回避策を使用することができます。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4cadba7a29 advisory.

    CVE-2024-52805, CVE-2024-52815, CVE-2024-53863, CVE-2024-53867

    ----

    Backport fixes from v1.120.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 71f3e9f0-bafc-11ef-885d-901b0e934d69 advisory.

    element-hq/synapse developers report:
    [The 1.120.1] release fixes multiple security                     vulnerabilities, some affecting all prior versions of                     Synapse. Server administrators are encouraged to                     update Synapse as soon as possible. We are not aware                     of these vulnerabilities being exploited in the                     wild.
    Administrators who are unable to update Synapse may                     use the workarounds described in the linked GitHub                     Security Advisory below.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
410638	SCA: security update for matrix-synapse (GHSA-56w4-5538-8v8h)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
427536	Alpine: multiple synapse packages: security update to 1.120.1	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
426110	Alpine: multiple synapse packages: security update to 1.120.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
427536	Alpine: multiple synapse packages: security update to 1.120.1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
426110	Alpine: multiple synapse packages: security update to 1.120.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	high
410638	SCA: security update for matrix-synapse (GHSA-56w4-5538-8v8h)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
212753	Fedora 41 : matrix-synapse (2024-4cadba7a29)	Nessus	Fedora Local Security Checks	2024/12/13	2025/8/27	high
213068	FreeBSD : py-matrix-synapse -- 1.120.1 より前のバージョンにある複数の脆弱性 (71f3e9f0-bafc-11ef-885d-901b0e934d69)	Nessus	FreeBSD Local Security Checks	2024/12/17	2025/8/27	high
212753	Fedora 41 : matrix-synapse (2024-4cadba7a29)	Nessus	Fedora Local Security Checks	2024/12/13	2025/8/27	high
213068	FreeBSD : py-matrix-synapse -- multiple vulnerabilities in versions prior to 1.120.1 (71f3e9f0-bafc-11ef-885d-901b0e934d69)	Nessus	FreeBSD Local Security Checks	2024/12/17	2025/8/27	high

检测

插件搜索

medium

high

high

high

high

medium

high

high

high

high