CVE-2021-39164

Published: 31 August 2021

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.

Priority

Cvss 3 Severity Score

3.1

Score breakdown

Status

Package	Release	Status
matrix-synapse Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	trusty	Does not exist
	xenial	Ignored (end of standard support)
	hirsute	Ignored (end of life)
	upstream	Released (1.41.1-1)
	jammy	Needs triage
	impish	Ignored (end of life)
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Not vulnerable (1.64.0-3)
	mantic	Not vulnerable (1.64.0-3)

Severity score breakdown

Parameter	Value
Base score	3.1
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›