CVE-2021-39163
2 advisories.
PyPI/matrix-synapse CVE-2021-39163: low 3.1, EPSS 0.90%
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Action: Upgrade matrix-synapse to 1.41.1 or later.
pip install matrix-synapse==1.41.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.41.1 | - |
Fixed versions
| 1.41.1 |
Sources
- osv: GHSA-jj53-8fmw-f2w2
- https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2
- https://nvd.nist.gov/vuln/detail/CVE-2021-39163
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://github.com/matrix-org/synapse
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-424.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN
CVE-2021-39163 · published · modified · JSON
PyPI/matrix-synapse CVE-2021-39163: unknown, EPSS 0.90%
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if th
Action: Upgrade matrix-synapse to 1.41.1 or later.
pip install matrix-synapse==1.41.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.41.1 | - |
Fixed versions
| 1.41.1 |
Sources
- osv: PYSEC-2021-424
- https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
CVE-2021-39163 · published · modified · JSON