[Bug 1096833] New: VUL-0: matrix-synapse: event visibility rules not applied correctly
http://bugzilla.opensuse.org/show_bug.cgi?id=1096833 Bug ID: 1096833 Summary: VUL-0: matrix-synapse: event visibility rules not applied correctly Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: okurz@suse.com Reporter: astieger@suse.com QA Contact: security-team@suse.de Found By: --- Blocker: --- from https://github.com/matrix-org/synapse/releases/tag/v0.31.1 Changes in synapse v0.31.1 (2018-06-08) v0.31.1 fixes a security bug in the get_missing_events federation API where event visibility rules were not applied correctly. We are not aware of it being actively exploited but please upgrade asap. Bug Fixes: Fix event filtering in get_missing_events handler (PR #3371) https://github.com/matrix-org/synapse/commit/ad9edd1d968f19dd4d7c65102fe5520... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1096833 http://bugzilla.opensuse.org/show_bug.cgi?id=1096833#c1 Andreas Stieger <astieger@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |okurz@suse.com --- Comment #1 from Andreas Stieger <astieger@suse.com> --- *** Bug 1096832 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1096833 http://bugzilla.opensuse.org/show_bug.cgi?id=1096833#c2 --- Comment #2 from Andreas Stieger <astieger@suse.com> --- to backport, run osc mbranch matrix-synapse, and apply the following patch: https://github.com/matrix-org/synapse/pull/3371/commits/0834b49c6a9b6c597a15... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1096833 http://bugzilla.opensuse.org/show_bug.cgi?id=1096833#c9 --- Comment #9 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1096833) was mentioned in https://build.opensuse.org/request/show/1037916 Backports:SLE-15-SP4 / matrix-synapse -- You are receiving this mail because: You are on the CC list for the bug.
participants (2)
-
bugzilla_noreply＠novell.com -
bugzilla_noreply＠suse.com