~ / search / GHSA-mp92-3jfm-3575

GHSA-mp92-3jfm-3575

Synapse vulnerable to leak of remote user device information

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-43796

Packages

EcosystemPackageAffectedFixed in
PyPI matrix-synapse < 1.95.1 1.95.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. ### Patches System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible. ### Workarounds The `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

References

External links from the advisory. They lead to third-party sites.