Synapse vulnerable to leak of remote user device information

TRUNG BÌNH 5.3CVE-2023-43796 · GHSA-mp92-3jfm-3575 · PYSEC-2023-230 · Công bố 31/10/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-43796 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng matrix-synapse, synapse (matrix).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.2%, cao hơn 68.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.95.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
matrix-synapse PyPI	`< 1.95.1`	`1.95.1`
synapse matrix	`< 1.95.1`	`1.95.1`

Mô tả

Impact

Cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver.

Patches

System administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible.

Workarounds

The federation_domain_whitelist can be used to limit federation traffic with a homeserver.

Mô tả của NVD

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.