CVE-2023-43796

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-43796
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f Patch
https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f Patch
https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 Vendor Advisory
https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/ Mailing List
https://security.gentoo.org/glsa/202401-12
https://security.gentoo.org/glsa/202401-12
Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

13 Feb 2025, 17:17

Type Values Removed Values Added
Summary Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver. Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.
References (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 - Vendor Advisory () https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 - Vendor Advisory
References (MISC) https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f - Patch () https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f - Patch

07 Jan 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-12 -

28 Dec 2023, 16:13

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/ - Mailing List
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Fedoraproject

10 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/ -

08 Nov 2023, 17:59

Type Values Removed Values Added
References (MISC) https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f - (MISC) https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f - Patch
References (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 - (MISC) https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 - Vendor Advisory
First Time Matrix synapse
Matrix
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-200 NVD-CWE-noinfo
CPE cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*

31 Oct 2023, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-31 17:15

Updated : 2025-02-13 17:17

NVD link : CVE-2023-43796

Mitre link : CVE-2023-43796

JSON object : View

Products Affected

matrix

  • synapse

fedoraproject

  • fedora
CWE
NVD-CWE-noinfo