From ea10cdbea703f94a84a484377485de8dc14a963a Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Tue, 28 Jun 2022 14:33:56 +0100 Subject: 1.61.1 --- CHANGES.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'CHANGES.md') diff --git a/CHANGES.md b/CHANGES.md index bd9b34dd7a..b97f014142 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,24 @@ +Synapse 1.61.1 (2022-06-28) +=========================== + +This patch release fixes a security issue regarding URL previews, affecting all prior versions of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild. + +Server administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below. + +## Security advisory + +The following issue is fixed in 1.61.1. + +* [GHSA-22p3-qrh9-cx32](https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32) / [CVE-2022-31052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31052) + + Synapse instances with the [`url_preview_enabled`](https://matrix-org.github.io/synapse/v1.61/usage/configuration/config_documentation.html#media-store) homeserver config option set to `true` are affected. URL previews of some web pages can lead to unbounded recursion, causing the request to either fail, or in some cases crash the running Synapse process. + + Requesting URL previews requires authentication. Nevertheless, it is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. + + Homeservers with the `url_preview_enabled` configuration option set to `false` (the default) are unaffected. Instances with the `enable_media_repo` configuration option set to `false` are also unaffected, as this also disables URL preview functionality. + + Fixed by fa1308061802ac7b7d20e954ba7372c5ac292333. + Synapse 1.61.0 (2022-06-14) =========================== -- cgit 1.4.1 From 09d89ddc1f875bb1ea835a7614980787d4ebd043 Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Tue, 28 Jun 2022 14:41:06 +0100 Subject: Linkify GHSA commit --- CHANGES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'CHANGES.md') diff --git a/CHANGES.md b/CHANGES.md index b97f014142..0db01d4096 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -17,7 +17,7 @@ The following issue is fixed in 1.61.1. Homeservers with the `url_preview_enabled` configuration option set to `false` (the default) are unaffected. Instances with the `enable_media_repo` configuration option set to `false` are also unaffected, as this also disables URL preview functionality. - Fixed by fa1308061802ac7b7d20e954ba7372c5ac292333. + Fixed by [fa1308061802ac7b7d20e954ba7372c5ac292333](https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333). Synapse 1.61.0 (2022-06-14) =========================== -- cgit 1.4.1