There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
    prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know
    the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the
    room and untrusted users are permitted to create groups (communities). By default, only homeserver
    administrators can create groups. However, homeserver administrators can already access this information
    in the database or using the admin API. As a result, only homeservers where the configuration setting
    `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to
    1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators
    can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value)
    to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could,
    with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms`
    and `/_matrix/client/unstable/groups/{group_id}/rooms`. (CVE-2021-39163)

  - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
    prior, unauthorised users can access the membership (list of members, with their display names) of a room
    if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
    Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the
    room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One
    workaround is available. Administrators of servers that use a reverse proxy could, with potentially
    unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with
    `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
    (CVE-2021-39164)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
    prior, unauthorised users can access the membership (list of members, with their display names) of a room
    if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
    Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the
    room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One
    workaround is available. Administrators of servers that use a reverse proxy could, with potentially
    unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with
    `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
    (CVE-2021-39164)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Matrix 是一个用于开放联合即时消息和 IP 语音的生态系统。在版本 1.41.0 和更低版本中未经授权的用户只要知道聊天室的 ID就可访问聊天室的成员资格包括显示名称的成员列表。此漏洞仅限于具有“shared”历史记录可见性的聊天室。
    此外未经授权的用户一定是在room 中易受攻击的homeserver 上使用帐户。服务器管理员应升级到 1.41.1 或更高版本才能获得修补程序。有一个变通方案可用。使用反向代理的服务器管理员可阻断具有“at”查询参数的“/_matrix/client/r0/rooms/{room_id}/members”端点和“/_matrix/client”从而造成可能不可接受的功能丢失包含“at”查询参数的 /unstable/rooms/{room_id}/members。
    (CVE-2021-39164)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Matrix 是開放式同盟即時訊息和 IP 語音的生態系統。在 1.41.0 版和更舊版本中如果未經授權的使用者知道聊天室的 ID則其可存取聊天室的成員資格 (成員清單及其顯示名稱)。此弱點會限制於具有「shared」歷程記錄可見度的聊天室。
    此外未經授權的使用者必須使用協作室內有弱點的主伺服器上的帳戶。伺服器管理員應升級至 1.41.1 或更新版本以便接收修補程式。現已提供一個因應措施。使用反向代理伺服器的伺服器系統管理員可透過 `at` 查詢參數和 `/_matrix/client 在可能無法接受的功能遺失情況下封鎖端點/unstable/rooms/{room_id}/members` 含有 `at` 查詢參數。
    (CVE-2021-39164)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Matrix は、オープンフェデレーションの Instant Messaging および Voice over IP のエコシステムです。バージョン 1.41.0 以前では、権限なしのユーザーがルールの ID を知っている場合、ルールのメンバーシップ表示名付きのメンバーリストにアクセスできます。この脆弱性は、「共有」履歴可視性のあるルームに限定されます。
    さらに、不正なユーザーは、ルーム内にある脆弱なホームサーバーのアカウントを使用している必要があります。サーバー管理者は、パッチを受け取るために 1.41.1 以降にアップグレードする必要があります。1 つの回避策があります。リバースプロキシを使用するサーバーの管理者は、受け入れられない機能損失の可能性を起こし、エンドポイント「/_matrix/client/r0/rooms/{room_id}/members」を「at」クエリパラメーターでブロックし、「/_matrix/client」をブロックする可能性があります。 「at」クエリパラメーターで /unstable/rooms/{room_id}/members
    (CVE-2021-39164)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

マトリクス開発者レポート：

このリリースは、プライベートルームに関するメタデータを漏洩する可能性がある、2つの重要度中の問題にパッチを適用します。

- CVE-2021-39164: プライベートルームのメンバーとその表示名のリストを列挙する。

- CVE-2021-39163: プライベートルームの名前、アバター、トピック、メンバーの数を開示する。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and     prior, unauthorised users can access the membership (list of members, with their display names) of a room     if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
    Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the     room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One     workaround is available. Administrators of servers that use a reverse proxy could, with potentially     unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with     `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
    (CVE-2021-39164)

Note that Nessus relies on the presence of the package as reported by the vendor.

Matrix developers report :

This release patches two moderate severity issues which could reveal metadata about private rooms :

- CVE-2021-39164: Enumerating a private room's list of members and their display names.

- CVE-2021-39163: Disclosing a private room's name, avatar, topic, and number of members.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
400128	Alpine: multiple synapse packages: security update to 1.41.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/8/16	2026/7/2	low
409754	SCA: security update for matrix-synapse (GHSA-3x4c-pq33-4w3q)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	low
409754	SCA: security update for matrix-synapse (GHSA-3x4c-pq33-4w3q)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	low
400128	Alpine: multiple synapse packages: security update to 1.41.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/8/16	2026/7/2	low
426812	Alpine: multiple synapse packages: security update to 1.41.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	low
426812	Alpine: multiple synapse packages: security update to 1.41.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	low
259839	Linux Distros 未修补的漏洞：CVE-2021-39164	Nessus	Misc.	2025/8/30	2026/8/11	low
259839	Linux Distros 未修補的弱點：CVE-2021-39164	Nessus	Misc.	2025/8/30	2026/8/11	low
259839	Linux Distros のパッチ未適用の脆弱性: CVE-2021-39164	Nessus	Misc.	2025/8/30	2026/8/11	low
153074	FreeBSD：py-matrix-synapse -- いくつかの脆弱性（a67e358c-0bf6-11ec-875e-901b0e9408dc）	Nessus	FreeBSD Local Security Checks	2021/9/7	2021/9/10	low
259839	Linux Distros Unpatched Vulnerability : CVE-2021-39164	Nessus	Misc.	2025/8/30	2026/8/11	low
153074	FreeBSD : py-matrix-synapse -- several vulnerabilities (a67e358c-0bf6-11ec-875e-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2021/9/7	2021/9/10	low

检测

插件搜索

low

low

low

low

low

low

low

low

low

low

low

low