summary refs log tree commit diff
path: root/CHANGES.md
diff options
context:
space:
mode:
authorSean Quah <seanq@matrix.org>2022-08-31 11:18:56 +0100
committerSean Quah <seanq@matrix.org>2022-08-31 11:18:56 +0100
commitd48b70fd37888346fc6a4c800ecfaa6a2395d087 (patch)
tree4efcecd6d4b9b817dc82fc332614bcc55117b59d /CHANGES.md
parentRemind people that direct TCP replication is disabled. (#13674) (diff)
downloadsynapse-d48b70fd37888346fc6a4c800ecfaa6a2395d087.tar.xz
Update changelog for v1.62.0
Diffstat (limited to 'CHANGES.md')
-rw-r--r--CHANGES.md14
1 files changed, 14 insertions, 0 deletions
diff --git a/CHANGES.md b/CHANGES.md
index 0f822556ec..9ba9498344 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -398,6 +398,20 @@ No significant changes since 1.62.0rc3.
 
 Authors of spam-checker plugins should consult the [upgrade notes](https://github.com/matrix-org/synapse/blob/release-v1.62/docs/upgrade.md#upgrading-to-v1620) to learn about the enriched signatures for spam checker callbacks, which are supported with this release of Synapse.
 
+## Security advisory
+
+The following issue is fixed in 1.62.0.
+
+* [GHSA-jhjh-776m-4765](https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765) / [CVE-2022-31152](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31152)
+
+  Synapse instances prior to 1.62.0 did not implement the Matrix [event authorization rules](https://spec.matrix.org/v1.3/rooms/v10/#authorization-rules) correctly. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.
+
+  Homeservers with federation disabled via the [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) config option are unaffected.
+
+  Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.
+
+  Fixed by [#13087](https://github.com/matrix-org/synapse/pull/13087) and [#13088](https://github.com/matrix-org/synapse/pull/13088).
+
 Synapse 1.62.0rc3 (2022-07-04)
 ==============================