Bug 2247493 (CVE-2023-43796) - CVE-2023-43796 net-im/synapse: Leak of remote user device information
Summary: CVE-2023-43796 net-im/synapse: Leak of remote user device information
Keywords:
Status: NEW
Alias: CVE-2023-43796
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2247494
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-11-01 15:18 UTC by Robb Gatica
Modified: 2023-11-01 15:19 UTC (History)
0 users

Fixed In Version: synapse 1.95.1, synapse 1.96.0rc1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Robb Gatica 2023-11-01 15:18:58 UTC 
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.


https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575
https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f
Comment 1 Robb Gatica 2023-11-01 15:19:14 UTC 
Created synapse tracking bugs for this issue:

Affects: fedora-all [bug 2247494]
Note You need to log in before you can comment on or make changes to this bug.