Detections
Analytics

Alpine: multiple synapse packages: security update to 1.41.1-r0

low Tenable Self-Hosted Container Security Plugin ID 426812

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know
 the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the
 room and untrusted users are permitted to create groups (communities). By default, only homeserver
 administrators can create groups. However, homeserver administrators can already access this information
 in the database or using the admin API. As a result, only homeservers where the configuration setting
 `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to
 1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators
 can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value)
 to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could,
 with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms`
 and `/_matrix/client/unstable/groups/{group_id}/rooms`. (CVE-2021-39163)

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the membership (list of members, with their display names) of a room
 if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
 Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the
 room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One
 workaround is available. Administrators of servers that use a reverse proxy could, with potentially
 unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with
 `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
 (CVE-2021-39164)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-39163

https://security.alpinelinux.org/vuln/CVE-2021-39164

Plugin Details

Severity: Low

ID: 426812

Version: Revision 1.3

Type: Local

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-39164

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 0.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2021-39163

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/31/2021

Reference Information

CVE: CVE-2021-39163, CVE-2021-39164