summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.circleci/config.yml8
-rw-r--r--CHANGES.md104
-rw-r--r--changelog.d/8906.misc1
-rw-r--r--synapse/__init__.py2
4 files changed, 59 insertions, 56 deletions
diff --git a/.circleci/config.yml b/.circleci/config.yml

index b10cbedd6d..088da55735 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml
@@ -5,7 +5,6 @@ jobs: - image: docker:git steps: - checkout - - setup_remote_docker - docker_prepare - run: docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD - docker_build: @@ -20,7 +19,6 @@ jobs: - image: docker:git steps: - checkout - - setup_remote_docker - docker_prepare - run: docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD - docker_build: @@ -46,12 +44,16 @@ workflows: commands: docker_prepare: - description: Downloads the buildx cli plugin and enables multiarch images + description: Sets up a remote docker server, downloads the buildx cli plugin, and enables multiarch images parameters: buildx_version: type: string default: "v0.4.1" steps: + - setup_remote_docker: + # 19.03.13 was the most recent available on circleci at the time of + # writing. + version: 19.03.13 - run: apk add --no-cache curl - run: mkdir -vp ~/.docker/cli-plugins/ ~/dockercache - run: curl --silent -L "https://github.com/docker/buildx/releases/download/<< parameters.buildx_version >>/buildx-<< parameters.buildx_version >>.linux-amd64" > ~/.docker/cli-plugins/docker-buildx diff --git a/CHANGES.md b/CHANGES.md
index 6c70371ded..0cecb83498 100644 --- a/CHANGES.md +++ b/CHANGES.md
@@ -44,6 +44,58 @@ Internal Changes - Add a maximum version for pysaml2 on Python 3.5. ([\#8898](https://github.com/matrix-org/synapse/issues/8898)) +Synapse 1.23.1 (2020-12-09) +=========================== + +Due to the two security issues highlighted below, server administrators are +encouraged to update Synapse. We are not aware of these vulnerabilities being +exploited in the wild. + +Security advisory +----------------- + +The following issues are fixed in v1.23.1 and v1.24.0. + +- There is a denial of service attack + ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257)) + against the federation APIs in which future events will not be correctly sent + to other servers over federation. This affects all servers that participate in + open federation. (Fixed in [#8776](https://github.com/matrix-org/synapse/pull/8776)). + +- Synapse may be affected by OpenSSL + [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). + Synapse administrators should ensure that they have the latest versions of + the cryptography Python package installed. + +To upgrade Synapse along with the cryptography package: + +* Administrators using the [`matrix.org` Docker + image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu + packages from + `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages) + should ensure that they have version 1.24.0 or 1.23.1 installed: these images include + the updated packages. +* Administrators who have [installed Synapse from + source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source) + should upgrade the cryptography package within their virtualenv by running: + ```sh + <path_to_virtualenv>/bin/pip install 'cryptography>=3.3' + ``` +* Administrators who have installed Synapse from distribution packages should + consult the information from their distributions. + +Bugfixes +-------- + +- Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](https://github.com/matrix-org/synapse/issues/8776)) + + +Internal Changes +---------------- + +- Add a maximum version for pysaml2 on Python 3.5. ([\#8898](https://github.com/matrix-org/synapse/issues/8898)) + + Synapse 1.24.0rc2 (2020-12-04) ============================== @@ -131,58 +183,6 @@ Internal Changes - Allow for specifying a room version when creating a room in unit tests via `RestHelper.create_room_as`. ([\#8854](https://github.com/matrix-org/synapse/issues/8854)) -Synapse 1.23.1 (2020-12-09) -=========================== - -Due to the two security issues highlighted below, server administrators are -encouraged to update Synapse. We are not aware of these vulnerabilities being -exploited in the wild. - -Security advisory ------------------ - -The following issues are fixed in v1.23.1 and v1.24.0. - -- There is a denial of service attack - ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257)) - against the federation APIs in which future events will not be correctly sent - to other servers over federation. This affects all servers that participate in - open federation. (Fixed in [#8776](https://github.com/matrix-org/synapse/pull/8776)). - -- Synapse may be affected by OpenSSL - [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). - Synapse administrators should ensure that they have the latest versions of - the cryptography Python package installed. - -To upgrade Synapse along with the cryptography package: - -* Administrators using the [`matrix.org` Docker - image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu - packages from - `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages) - should ensure that they have version 1.24.0 or 1.23.1 installed: these images include - the updated packages. -* Administrators who have [installed Synapse from - source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source) - should upgrade the cryptography package within their virtualenv by running: - ```sh - <path_to_virtualenv>/bin/pip install 'cryptography>=3.3' - ``` -* Administrators who have installed Synapse from distribution packages should - consult the information from their distributions. - -Bugfixes --------- - -- Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](https://github.com/matrix-org/synapse/issues/8776)) - - -Internal Changes ----------------- - -- Add a maximum version for pysaml2 on Python 3.5. ([\#8898](https://github.com/matrix-org/synapse/issues/8898)) - - Synapse 1.23.0 (2020-11-18) =========================== diff --git a/changelog.d/8906.misc b/changelog.d/8906.misc new file mode 100644
index 0000000000..8b95e4c553 --- /dev/null +++ b/changelog.d/8906.misc
@@ -0,0 +1 @@ +Fix multiarch docker image builds. diff --git a/synapse/__init__.py b/synapse/__init__.py
index c38a8f613d..f2d3ac68eb 100644 --- a/synapse/__init__.py +++ b/synapse/__init__.py
@@ -48,7 +48,7 @@ try: except ImportError: pass -__version__ = "1.23.1" +__version__ = "1.24.0" if bool(os.environ.get("SYNAPSE_TEST_PATCH_LOG_CONTEXTS", False)): # We import here so that we don't have to install a bunch of deps when