{"id":"DEBIAN-CVE-2018-16515","details":"Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.","modified":"2026-08-11T20:02:58.683154751Z","published":"2018-09-18T21:29:03.010Z","withdrawn":"2026-08-11T20:02:58.683154414Z","upstream":["CVE-2018-16515"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2018-16515"}],"affected":[{"package":{"name":"matrix-synapse","ecosystem":"Debian:14","purl":"pkg:deb/debian/matrix-synapse?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33.3.1-1"}]}],"versions":["0.19.2+dfsg-3","0.19.2+dfsg-4","0.19.2+dfsg-5","0.19.2+dfsg-6","0.24.0+dfsg-1","0.27.2+dfsg-1","0.28.0+dfsg-1","0.28.0+dfsg-2","0.28.1+dfsg-1","0.29.1+dfsg-1","0.30.0+dfsg-1","0.31.0+dfsg-1","0.31.0+dfsg-2","0.31.1+dfsg-1","0.31.1+dfsg-2","0.31.2+dfsg-1","0.32.2+dfsg-1","0.33.0+dfsg-1","0.33.1+dfsg-1","0.33.2+dfsg-1","0.33.2+dfsg-2","0.33.2+dfsg-3","0.33.3-1","0.33.3-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-16515.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}