watcha-synapse

History

Erik Johnston 320e8c8064 Synapse 1.23.1 (2020-12-09) =========================== Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild. Security advisory ----------------- The following issues are fixed in v1.23.1 and v1.24.0. - There is a denial of service attack ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257)) against the federation APIs in which future events will not be correctly sent to other servers over federation. This affects all servers that participate in open federation. (Fixed in [#8776](https://github.com/matrix-org/synapse/pull/8776)). - Synapse may be affected by OpenSSL [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). Synapse administrators should ensure that they have the latest versions of the cryptography Python package installed. To upgrade Synapse along with the cryptography package: * Administrators using the [`matrix.org` Docker image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu packages from `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages) should ensure that they have version 1.24.0 or 1.23.1 installed: these images include the updated packages. * Administrators who have [installed Synapse from source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source) should upgrade the cryptography package within their virtualenv by running: ```sh <path_to_virtualenv>/bin/pip install 'cryptography>=3.3' ``` * Administrators who have installed Synapse from distribution packages should consult the information from their distributions. Bugfixes -------- - Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](https://github.com/matrix-org/synapse/issues/8776)) Internal Changes ---------------- - Add a maximum version for pysaml2 on Python 3.5. ([\#8898](https://github.com/matrix-org/synapse/issues/8898)) -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEBTGR3/RnAzBGUif3pULk7RsPrAkFAl/QsOYQHGVyaWtAbWF0 cml4Lm9yZwAKCRClQuTtGw+sCZTkCACEDbyMY/UCqJaUILxtYeBE7K4GvOqPPHyo 2VLjyitI7XWVzB/paUOPxAtOtiwXS0GOrL+UsW6Lky2HIjafjLe1Z3LHzATQwF2I J2bZWTY1Y4v3y8B7noPmp7+QFIBIey++09BY+MwzT3EQYnXt6lvoHmEvPH/htzjg LfdZpSj4WrJr4S2/W0rVlkGSuIShN0Tnv6pTgbGRZMt1N4JH2mo65mCGt3xrMS7E us+xqStGh5Q+9g3F913iIJ8noUMeCvTT7hbr1eonhZ3MIKWG30z+zcXwmGb0t3B8 zvTFXqdbZPSw+ZZdxaZwZuJzNCnYOu6t0JuzXqDoE0xsHb8RVUe9 =Z9US -----END PGP SIGNATURE----- Merge tag 'v1.23.1' Synapse 1.23.1 (2020-12-09) =========================== Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild. Security advisory ----------------- The following issues are fixed in v1.23.1 and v1.24.0. - There is a denial of service attack ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257)) against the federation APIs in which future events will not be correctly sent to other servers over federation. This affects all servers that participate in open federation. (Fixed in [#8776](https://github.com/matrix-org/synapse/pull/8776)). - Synapse may be affected by OpenSSL [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). Synapse administrators should ensure that they have the latest versions of the cryptography Python package installed. To upgrade Synapse along with the cryptography package: * Administrators using the [`matrix.org` Docker image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu packages from `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages) should ensure that they have version 1.24.0 or 1.23.1 installed: these images include the updated packages. * Administrators who have [installed Synapse from source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source) should upgrade the cryptography package within their virtualenv by running: ```sh <path_to_virtualenv>/bin/pip install 'cryptography>=3.3' ``` * Administrators who have installed Synapse from distribution packages should consult the information from their distributions. Bugfixes -------- - Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](https://github.com/matrix-org/synapse/issues/8776)) Internal Changes ---------------- - Add a maximum version for pysaml2 on Python 3.5. ([\#8898](https://github.com/matrix-org/synapse/issues/8898))		4 years ago
..
po	Add information about .well-known to Debian installation. (#7227 )	5 years ago
source	Debian packaging via dh_virtualenv (#4285 )	6 years ago
test	Some vagrant hackery for testing the debs	6 years ago
.gitignore	Debian packaging via dh_virtualenv (#4285 )	6 years ago
NEWS	Mention updating extensions	6 years ago
build_virtualenv	Explicitly install test dependencies when building deb packages (#8523 )	4 years ago
changelog	Synapse 1.23.1 (2020-12-09)	4 years ago
compat	import from package-debian-synapse	6 years ago
control	Remove libsqlite3-dev from required build dependencies. (#5766 )	5 years ago
copyright	Debian packaging via dh_virtualenv (#4285 )	6 years ago
dirs	import from package-debian-synapse	6 years ago
hash_password.1	import from package-debian-synapse	6 years ago
hash_password.ronn	import from package-debian-synapse	6 years ago
install	Automate generation of the sample and debian log configs (#6627 )	5 years ago
manage_debconf.pl	Debian: fix overwriting of config settings on upgrade (#4696 )	6 years ago
manpages	import from package-debian-synapse	6 years ago
matrix-synapse-py3.config	Debian package: fix warning during preconfiguration.	6 years ago
matrix-synapse-py3.links	Debian packaging via dh_virtualenv (#4285 )	6 years ago
matrix-synapse-py3.postinst	Debian: fix overwriting of config settings on upgrade (#4696 )	6 years ago
matrix-synapse-py3.preinst	Debian packaging via dh_virtualenv (#4285 )	6 years ago
matrix-synapse-py3.triggers	Debian packaging via dh_virtualenv (#4285 )	6 years ago
matrix-synapse.default	Various improvements to the docs (#7899 )	4 years ago
matrix-synapse.service	Update debian systemd service to use Type=notify (#8169 )	4 years ago
register_new_matrix_user.1	import from package-debian-synapse	6 years ago
register_new_matrix_user.ronn	import from package-debian-synapse	6 years ago
rules	Fix the debian build in a better way. (#7212 )	5 years ago
synapse_port_db.1	import from package-debian-synapse	6 years ago
synapse_port_db.ronn	import from package-debian-synapse	6 years ago
synctl.1	import from package-debian-synapse	6 years ago
synctl.ronn	Various improvements to the docs (#7899 )	4 years ago
templates	Add information about .well-known to Debian installation. (#7227 )	5 years ago