The following issues are fixed in 1.120.1. GHSA-rfq8-j7rh-8hf2 / CVE-2024-52805 (high): Unsupported content types can lead to memory exhaustion Synapse instances which have a high max_upload_size and which don't have a reverse proxy in front of them that would otherwise limit upload size are affected. Fixed by 4b7154c58501b4bf5e1c2d6c11ebef96529f2fdf. GHSA-f3r3-h2mq-hx2h / CVE-2024-52815 (high): Malicious invites via federation can break a user's sync Fixed by d82e1ed357b7ee21dff83d06cba7a67840cfd464. GHSA-vp6v-whfm-rv3g / CVE-2024-53863 (high): Synapse can be forced to thumbnail unexpected file formats, invoking potentially untrustworthy decoders Synapse instances can disable dynamic thumbnailing by setting dynamic_thumbnails to false in the configuration file. Fixed by b64a4e5fbbbf119b6c65aedf0d999b4237d55503. GHSA-56w4-5538-8v8h / CVE-2024-53867 (moderate): The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room Non-state events, like messages, are unaffected. Synapse instances can disable the Sliding Sync feature by setting experimental_features.msc3575_enabled to false in the configuration file. Fixed by 4daa533e82f345ce87b9495d31781af570ba3ead. Additionally, we disclose the following vulnerabilities, both have been fixed in Synapse 1.106.0: GHSA-4mhg-xv73-xq2x / CVE-2024-37302 (high): Denial of service through media disk space consumption GHSA-gjgr-7834-rhxr / CVE-2024-37303 (moderate): Unauthenticated writes to the media repository allow planting of problematic content
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=61da45e2a13f78fae1be313540872b57edd3f025 commit 61da45e2a13f78fae1be313540872b57edd3f025 Author: Petr Vaněk <arkamar@gentoo.org> AuthorDate: 2024-12-03 17:18:35 +0000 Commit: Petr Vaněk <arkamar@gentoo.org> CommitDate: 2024-12-03 17:51:01 +0000 net-im/synapse: add 1.120.2 Bug: https://bugs.gentoo.org/945823 Signed-off-by: Petr Vaněk <arkamar@gentoo.org> net-im/synapse/Manifest | 1 + net-im/synapse/synapse-1.120.2.ebuild | 242 ++++++++++++++++++++++++++++++++++ 2 files changed, 243 insertions(+)
We use spaces instead of comma's in the Whiteboard field. :-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ab9bf03aa1a4a6372243ca5dd9341463938845a7 commit ab9bf03aa1a4a6372243ca5dd9341463938845a7 Author: Petr Vaněk <arkamar@gentoo.org> AuthorDate: 2024-12-09 10:03:44 +0000 Commit: Petr Vaněk <arkamar@gentoo.org> CommitDate: 2024-12-09 10:03:44 +0000 net-im/synapse: drop 1.118.0-r1, 1.119.0, 1.120.0 Bug: https://bugs.gentoo.org/945823 Signed-off-by: Petr Vaněk <arkamar@gentoo.org> net-im/synapse/Manifest | 14 -- net-im/synapse/synapse-1.118.0-r1.ebuild | 251 ------------------------------- net-im/synapse/synapse-1.119.0.ebuild | 250 ------------------------------ net-im/synapse/synapse-1.120.0.ebuild | 242 ----------------------------- 4 files changed, 757 deletions(-)
