Vulnerability · Published Aug 31, 2021 · Assigned by GitHub_M
CVE-2021-39164Improper authorisation of /members discloses room membership to non-members
Low 3.1
In plain English
A low-severity information exposure in synapse from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | synapse | 1.41.1-r0 | ALPINE-CVE-2021-39164 |
| Alpine:v3.21 | synapse | 1.41.1-r0 | ALPINE-CVE-2021-39164 |
| Alpine:v3.22 | synapse | 1.41.1-r0 | ALPINE-CVE-2021-39164 |
| Alpine:v3.23 | synapse | 1.41.1-r0 | ALPINE-CVE-2021-39164 |
| Alpine:v3.24 | synapse | 1.41.1-r0 | ALPINE-CVE-2021-39164 |
| Debian:14 | matrix-synapse | 1.41.1-1 | DEBIAN-CVE-2021-39164 |
| PyPI | matrix-synapse | 1.41.1 | GHSA-3x4c-pq33-4w3q |
| PyPI | matrix-synapse | 1.41.1 | PYSEC-2021-425 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | synapse | < 1.41.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/matrix-org/synapse/commit/cb35df940a x_refsource_MISC
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1 x_refsource_MISC
- https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q x_refsource_CONFIRM
- FEDORA-2021-2e8ed15b14 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-f12fdca1bf vendor-advisory, x_refsource_FEDORA