summary refs log tree commit diff
path: root/contrib
diff options
context:
space:
mode:
authorPatrick Cloke <patrickc@matrix.org>2020-07-02 10:54:29 -0400
committerPatrick Cloke <patrickc@matrix.org>2020-07-02 10:54:29 -0400
commitfedb632d0a22e4bad179a9b48be28a3a552315c9 (patch)
tree9f05e09e55851f8e272a5e1f722472f5aef04050 /contrib
parentUpdate postgres in the Docker compose example to 12-alpine. (#7696) (diff)
parentRemove an extraneous space. (diff)
downloadsynapse-fedb632d0a22e4bad179a9b48be28a3a552315c9.tar.xz
Merge tag 'v1.15.2'
Synapse 1.15.2 (2020-07-02)
===========================

Due to the two security issues highlighted below, server administrators are
encouraged to update Synapse. We are not aware of these vulnerabilities being
exploited in the wild.

Security advisory
-----------------

* A malicious homeserver could force Synapse to reset the state in a room to a
  small subset of the correct state. This affects all Synapse deployments which
  federate with untrusted servers. ([96e9afe6](https://github.com/matrix-org/synapse/commit/96e9afe62500310977dc3cbc99a8d16d3d2fa15c))
* HTML pages served via Synapse were vulnerable to clickjacking attacks. This
  predominantly affects homeservers with single-sign-on enabled, but all server
  administrators are encouraged to upgrade. ([ea26e9a9](https://github.com/matrix-org/synapse/commit/ea26e9a98b0541fc886a1cb826a38352b7599dbe))

  This was reported by [Quentin Gliech](https://sandhose.fr/).
Diffstat (limited to 'contrib')
0 files changed, 0 insertions, 0 deletions