matrix-synapse/matrix-synapse.obsinfo

name: matrix-synapse
version: 1.47.1
mtime: 1637347213
commit: 8fa83999d688bb4c1747f2237002422e566e085f
osc copypac from project:home:cyphar:matrix package:matrix-synapse revision:2 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=83 2019-10-04 00:23:50 +02:00			`name: matrix-synapse`
Accepting request 933284 from home:darix:apps - Update to 1.47.1 This release fixes a security issue in the media store, affecting all prior releases of Synapse. Server administrators are encouraged to update Synapse as soon as possible. We are not aware of these vulnerabilities being exploited in the wild. Server administrators who are unable to update Synapse may use the workarounds described in the linked GitHub Security Advisory below. - Security Advisory: GHSA-3hfw-x7gx-437c / CVE-2021-41281: Path traversal when downloading remote media. Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected. Fixed by 91f2bd090. OBS-URL: https://build.opensuse.org/request/show/933284 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=198 2021-11-23 15:50:11 +01:00			`version: 1.47.1`
			`mtime: 1637347213`
			`commit: 8fa83999d688bb4c1747f2237002422e566e085f`
osc copypac from project:home:cyphar:matrix package:matrix-synapse revision:2 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=83 2019-10-04 00:23:50 +02:00