CVE-2024-53863

Advisory

Affected versions of Synapse are vulnerable to sensitive system information exposure through image thumbnail generation. When dynamic_thumbnails is enabled, the system exposes information about and access to various image processing capabilities and helper programs like Ghostscript to unauthorized users. This unnecessarily reveals system components and expands the attack surface through uncommon image format processing. Users should upgrade to Synapse 1.120.1, which restricts thumbnail generation to PNG, JPEG, GIF, and WebP formats only. Alternatively, uninstall unused image decoder libraries and ensure remaining ones are patched.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53863