4.9

CVE-2023-45129: fedoraproject fedora

CVSS: 4.9v3.1MediumModified
AliasesGHSA-5chr-wjw5-3gq4PYSEC-2023-199UBUNTU-CVE-2023-45129
Published 10-10-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2023-45129 is a medium (CVSS 4.9) vulnerability in fedoraproject fedora. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.9% of scored vulnerabilities.

Overall risk
20/100
0100
Low · default modelHow is this calculated?
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.39%
0%100%
Low · +0.23 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-10-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected. Server administrators are advised to upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious server ACL events can be purged and blocked using the admin API.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.39%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

+0.23 pp

From 1.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • matrix-synapse< 1.94.0-1
Fedoraproject1 product
Matrix1 product
Matrix-org1 product
Opensuse1 product
  • matrix-synapse&distro=openSUSE Tumbleweed< 1.94.0-2.1
PyPI1 product
  • matrix-synapse< 1.94.0
Ubuntu1 product
  • matrix-synapseAll versions (No fix recorded)

7 vendors · 7 products

References

18 links
Show all 18 references