From 5bd783aded3ae4436c69b7b529031e1e499aa45255a63fdf2d6e848f2053e968 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <asarai@suse.com>
Date: Tue, 31 Aug 2021 14:35:09 +0000
Subject: [PATCH] Accepting request 915279 from home:darix:apps

- Update to 1.41.1

OBS-URL: https://build.opensuse.org/request/show/915279
OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=191
---
 _service                      |  2 +-
 matrix-synapse-1.41.0.obscpio |  3 ---
 matrix-synapse-1.41.1.obscpio |  3 +++
 matrix-synapse-test.spec      |  2 +-
 matrix-synapse.changes        | 48 +++++++++++++++++++++++++++++++++--
 matrix-synapse.obsinfo        |  6 ++---
 matrix-synapse.spec           |  2 +-
 7 files changed, 55 insertions(+), 11 deletions(-)
 delete mode 100644 matrix-synapse-1.41.0.obscpio
 create mode 100644 matrix-synapse-1.41.1.obscpio

diff --git a/_service b/_service
index da9edcd..703c6a1 100644
--- a/_service
+++ b/_service
@@ -4,7 +4,7 @@
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="url">https://github.com/matrix-org/synapse.git</param>
     <param name="scm">git</param>
-    <param name="revision">v1.41.0</param>
+    <param name="revision">v1.41.1</param>
     <param name="versionrewrite-pattern">v(.*)</param>
     <param name="versionrewrite-replacement">\1</param>
     <!--
diff --git a/matrix-synapse-1.41.0.obscpio b/matrix-synapse-1.41.0.obscpio
deleted file mode 100644
index 5727b71..0000000
--- a/matrix-synapse-1.41.0.obscpio
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e01b511c001907a2d809cc1fd9500946dfa9f7333de81150bbedcf807d9c002e
-size 30903309
diff --git a/matrix-synapse-1.41.1.obscpio b/matrix-synapse-1.41.1.obscpio
new file mode 100644
index 0000000..e75620c
--- /dev/null
+++ b/matrix-synapse-1.41.1.obscpio
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:551b407807772a38984769b5c74e7767d3f60e02a282a51533894236a7f39641
+size 30918669
diff --git a/matrix-synapse-test.spec b/matrix-synapse-test.spec
index 444f1b3..5d66cdb 100644
--- a/matrix-synapse-test.spec
+++ b/matrix-synapse-test.spec
@@ -27,7 +27,7 @@
 
 %define         pkgname matrix-synapse
 Name:           %{pkgname}-test
-Version:        1.41.0
+Version:        1.41.1
 Release:        0
 Summary:        Test package for %{pkgname}
 License:        Apache-2.0
diff --git a/matrix-synapse.changes b/matrix-synapse.changes
index 6ca74fd..7734beb 100644
--- a/matrix-synapse.changes
+++ b/matrix-synapse.changes
@@ -1,3 +1,47 @@
+-------------------------------------------------------------------
+Tue Aug 31 14:21:51 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
+
+- Update to 1.41.1
+  Due to the two security issues highlighted below, server
+  administrators are encouraged to update Synapse. We are not aware
+  of these vulnerabilities being exploited in the wild.
+
+  - Security advisory
+    The following issues are fixed in v1.41.1.
+
+    - GHSA-3x4c-pq33-4w3q / CVE-2021-39164: Enumerating a private
+      room's list of members and their display names.
+
+      If an unauthorized user both knows the Room ID of a private
+      room and that room's history visibility is set to shared,
+      then they may be able to enumerate the room's members,
+      including their display names.
+
+      The unauthorized user must be on the same homeserver as a
+      user who is a member of the target room.
+
+      Fixed by 52c7a51cf.
+
+    - GHSA-jj53-8fmw-f2w2 / CVE-2021-39163: Disclosing a private
+      room's name, avatar, topic, and number of members.
+
+      If an unauthorized user knows the Room ID of a private room,
+      then its name, avatar, topic, and number of members may be
+      disclosed through Group / Community features.
+
+      The unauthorized user must be on the same homeserver as a
+      user who is a member of the target room, and their homeserver
+      must allow non-administrators to create groups
+      (enable_group_creation in the Synapse configuration; off by
+      default).
+
+      Fixed by cb35df940a, #10723.
+
+  - Bugfixes
+    - Fix a regression introduced in Synapse 1.41 which broke email
+      transmission on systems using older versions of the Twisted
+      library. (#10713)
+
 -------------------------------------------------------------------
 Tue Aug 24 16:07:40 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
 
@@ -1734,9 +1778,9 @@ Wed Jan 13 12:28:54 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
   deprecated and will be removed in a future release. They will be
   replaced by the Delete Room APIe
 
-	POST /_synapse/admin/v1/rooms/<room_id>/delete replaces
+  POST /_synapse/admin/v1/rooms/<room_id>/delete replaces
   POST /_synapse/admin/v1/purge_room and
-	POST /_synapse/admin/v1/shutdown_room/<room_id>.
+  POST /_synapse/admin/v1/shutdown_room/<room_id>.
 
   - Features
     - Add an admin API that lets server admins get power in rooms
diff --git a/matrix-synapse.obsinfo b/matrix-synapse.obsinfo
index 8f46865..32f4fb5 100644
--- a/matrix-synapse.obsinfo
+++ b/matrix-synapse.obsinfo
@@ -1,5 +1,5 @@
 name: matrix-synapse
-version: 1.41.0
-mtime: 1629817593
-commit: f03cafb50c49a1569f1f99485f9cc42abfdc7b21
+version: 1.41.1
+mtime: 1630413808
+commit: a4c8a2f08b735266fbbe2f259e640f00dc5e3a00
 
diff --git a/matrix-synapse.spec b/matrix-synapse.spec
index d79ada7..146f84a 100644
--- a/matrix-synapse.spec
+++ b/matrix-synapse.spec
@@ -47,7 +47,7 @@
 %define         pkgname matrix-synapse
 %define         eggname matrix_synapse
 Name:           %{pkgname}
-Version:        1.41.0
+Version:        1.41.1
 Release:        0
 Summary:        Matrix protocol reference homeserver
 License:        Apache-2.0