{"id":"DEBIAN-CVE-2019-18835","details":"Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.","modified":"2026-08-11T20:49:50.118888483Z","published":"2019-11-08T00:15:10.413Z","withdrawn":"2026-08-11T20:49:50.118888316Z","upstream":["CVE-2019-18835"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2019-18835"}],"affected":[{"package":{"name":"matrix-synapse","ecosystem":"Debian:14","purl":"pkg:deb/debian/matrix-synapse?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}],"versions":["0.19.2+dfsg-3","0.19.2+dfsg-4","0.19.2+dfsg-5","0.19.2+dfsg-6","0.24.0+dfsg-1","0.27.2+dfsg-1","0.28.0+dfsg-1","0.28.0+dfsg-2","0.28.1+dfsg-1","0.29.1+dfsg-1","0.30.0+dfsg-1","0.31.0+dfsg-1","0.31.0+dfsg-2","0.31.1+dfsg-1","0.31.1+dfsg-2","0.31.2+dfsg-1","0.32.2+dfsg-1","0.33.0+dfsg-1","0.33.1+dfsg-1","0.33.2+dfsg-1","0.33.2+dfsg-2","0.33.2+dfsg-3","0.33.3-1","0.33.3-2","0.33.3.1-1","0.33.4-1","0.33.4-1~bpo9+1","0.33.8-1","0.33.9-2","0.33.9-2~bpo9+1","0.34.0-1","0.34.0-2","0.34.0-3","0.34.0-3~bpo9+1","0.34.0-3~bpo9+2","0.34.0~rc2-1","0.34.1.1-1","0.34.1.1-2","0.34.1.1-2~bpo9+1","0.34.1.1-3","0.34.1.1-3~bpo9+1","0.34.1.1-3~bpo9+2","0.34.1.1-4","0.99.0-1","0.99.0-1~bpo9+1","0.99.0-1~bpo9+2","0.99.0-1~bpo9+3","0.99.1.1-1","0.99.2-1","0.99.2-1~bpo9+1","0.99.2-1~bpo9+2","0.99.2-2","0.99.2-3","0.99.2-4","0.99.2-5","0.99.2-5~bpo9+1","0.99.2-6","0.99.3.2-1","0.99.5.1-1","0.99.5.2-1","1.0.0-1","1.0.0-2","1.0.0-2~bpo10+1","1.1.0-1","1.2.1-1","1.2.1-1~bpo10+1","1.2.1-1~bpo10+2","1.2.1-2","1.3.0-1","1.3.0-1~bpo10+1","1.4.0-1","1.4.0~rc1-1","1.5.0~rc1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-18835.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}