Synapse vulnerable to leak of remote user device information
ImpactCached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver.PatchesSystem administrators are encouraged to upgrade to Synapse 1.95.1 as soon as possible.WorkaroundsThe `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.