CVE-2019-5885

Source
Severity High
Remote No
Type Private key recovery
Description
matrix-synapse before 0.34.1 is vulnerable to private key recovery as synapse will attempt to derive a secret key from other secrets specified in the configuration file for "macaroon_secret_key". However, in all versions of Synapse up to and including 0.34.0, this process was faulty and a predictable value was used instead.
Group Package Affected Fixed Severity Status Ticket
AVG-846 matrix-synapse 0.34.0-1 0.34.1.1-1 High Fixed
Date Advisory Group Package Severity Description
24 Jan 2019 ASA-201901-12 AVG-846 matrix-synapse High private key recovery
References
https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/