Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-43796: Leak of remote user device information

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the federation_domain_whitelist can be used to limit federation traffic with a homeserver.

CVE

Package

pip matrix-synapse (pip)

Affected versions

< 1.95.1

Patched versions

1.95.1, 1.96.0rc1

Description

Impact

Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver.

Patches

System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible.

Workarounds

The federation_domain_whitelist can be used to limit federation traffic with a homeserver.

Related news

Gentoo Linux Security Advisory 202401-12

Gentoo Linux Security Advisory 202401-12 - Multiple vulnerabilities have been found in Synapse, the worst of which could result in information leaks. Versions greater than or equal to 1.96.0 are affected.

GHSA-mp92-3jfm-3575: Synapse vulnerable to leak of remote user device information

### Impact Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. ### Patches System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible. ### Workarounds The `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907