diff options
| author | Richard van der Hoff <richard@matrix.org> | 2018-05-02 16:16:01 +0100 |
|---|---|---|
| committer | Richard van der Hoff <richard@matrix.org> | 2018-05-02 16:16:01 +0100 |
| commit | 415c6b672ef08f4640cf48e80b62ca508e45279b (patch) | |
| tree | d2e1598e8258c33bac7f370c3e703b7c14403a52 /CHANGES.rst | |
| parent | Remove spurious unittest.DEBUG (diff) | |
| parent | Merge pull request #3172 from matrix-org/rav/fix_test_logcontext_leaks (diff) | |
| download | synapse-415c6b672ef08f4640cf48e80b62ca508e45279b.tar.xz | |
Merge branch 'develop' into rav/more_logcontext_leaks
Diffstat (limited to 'CHANGES.rst')
| -rw-r--r-- | CHANGES.rst | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/CHANGES.rst b/CHANGES.rst index 40d13c6484..317846d2a2 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -1,5 +1,26 @@ +Changes in synapse v0.28.1 (2018-05-01) +======================================= + +SECURITY UPDATE + +* Clamp the allowed values of event depth received over federation to be + [0, 2^63 - 1]. This mitigates an attack where malicious events + injected with depth = 2^63 - 1 render rooms unusable. Depth is used to + determine the cosmetic ordering of events within a room, and so the ordering + of events in such a room will default to using stream_ordering rather than depth + (topological_ordering). + + This is a temporary solution to mitigate abuse in the wild, whilst a long term solution + is being implemented to improve how the depth parameter is used. + + Full details at + https://docs.google.com/document/d/1I3fi2S-XnpO45qrpCsowZv8P8dHcNZ4fsBsbOW7KABI + +* Pin Twisted to <18.4 until we stop using the private _OpenSSLECCurve API. + + Changes in synapse v0.28.0 (2018-04-26) -=========================================== +======================================= Bug Fixes: |