Detections
Analytics

Alpine: multiple synapse packages: security update to 1.41.0-r0 (deprecated)

low Tenable Cloud Security Plugin ID 400128

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know
 the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the
 room and untrusted users are permitted to create groups (communities). By default, only homeserver
 administrators can create groups. However, homeserver administrators can already access this information
 in the database or using the admin API. As a result, only homeservers where the configuration setting
 `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to
 1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators
 can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value)
 to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could,
 with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms`
 and `/_matrix/client/unstable/groups/{group_id}/rooms`. (CVE-2021-39163)

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the membership (list of members, with their display names) of a room
 if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
 Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the
 room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One
 workaround is available. Administrators of servers that use a reverse proxy could, with potentially
 unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with
 `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
 (CVE-2021-39164)

See Also

https://git.alpinelinux.org/aports/commit/?id=3c496b7942c4d831d4621c3e56404c4145898a91

https://git.alpinelinux.org/aports/commit/?id=6fe7a17c11bea66f15414c8e7da4b533ffd3dd97

Plugin Details

Severity: Low

ID: 400128

Version: Revision 1.23

Type: Local

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-39164

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/31/2021

Vulnerability Publication Date: 8/31/2021

Reference Information

CVE: CVE-2021-39163, CVE-2021-39164