GitHub Advisoryadvisory · PyPI

GHSA-mp92-3jfm-3575 Synapse vulnerable to leak of remote user device information

MEDIUM Published 2023-10-31 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-43796
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-10-31

Affected packages

• PyPI matrix-synapse: < 1.95.1 → fixed in 1.95.1

Description

Impact Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. Patches System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible. Workarounds The `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

Related

Alias · CVE (1)

  • CVE-2023-43796 Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References