Synapse vulnerable to leak of remote user device information
Résumé
Synapse vulnerable to leak of remote user device information
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the federation_domain_whitelist can be used to limit federation traffic with a homeserver.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-43796 matrix-synapse Corrigé dans: 1.95.1-1
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org