PyPI/matrix-synapse CVE-2021-39164: unknown, EPSS 1.45%
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of
Action: Upgrade matrix-synapse to 1.41.1 or later.
pip install matrix-synapse==1.41.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.41.1 | - |
Fixed versions
| 1.41.1 |
Sources
- osv: PYSEC-2021-425
- https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
CVE-2021-39164 · published · modified · JSON