CVE-2021-39164
2 advisories.
PyPI/matrix-synapse CVE-2021-39164: low 3.1
Improper authorisation of members discloses room membership to non-members
Action: Upgrade matrix-synapse to 1.41.1 or later.
pip install matrix-synapse==1.41.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.41.1 | - |
Fixed versions
| 1.41.1 |
Sources
- osv: GHSA-3x4c-pq33-4w3q
- https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
- https://nvd.nist.gov/vuln/detail/CVE-2021-39164
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://github.com/matrix-org/synapse
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-425.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN
CVE-2021-39164 · published · modified · JSON
PyPI/matrix-synapse CVE-2021-39164: unknown
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of
Action: Upgrade matrix-synapse to 1.41.1 or later.
pip install matrix-synapse==1.41.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.41.1 | - |
Fixed versions
| 1.41.1 |
Sources
- osv: PYSEC-2021-425
- https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
CVE-2021-39164 · published · modified · JSON