GitHub Advisory DatabaseGHSA-MP92-3JFM-3575Synapse vulnerable to leak of remote user device information
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.0%
Impact
Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver.
Patches
System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible.
Workarounds
The federation_domain_whitelist can be used to limit federation traffic with a homeserver.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| matrix-synapse | lt | 1.95.1 |
References
github.com/advisories/GHSA-mp92-3jfm-3575
github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f
github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575
github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-230.yaml
lists.fedoraproject.org/archives/list/[email protected]/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/
lists.fedoraproject.org/archives/list/[email protected]/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/
nvd.nist.gov/vuln/detail/CVE-2023-43796
security.gentoo.org/glsa/202401-12
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.0%