Brendan Abolivier
6355ca39ad
Merge tag 'v1.41.1' into babolivier/dinsic_1.41.0
Synapse 1.41.1 (2021-08-31)
===========================
Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.
Security advisory
-----------------
The following issues are fixed in v1.41.1.
- **[GHSA-3x4c-pq33-4w3q](https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q) / [CVE-2021-39164](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39164): Enumerating a private room's list of members and their display names.**
If an unauthorized user both knows the Room ID of a private room *and* that room's history visibility is set to `shared`, then they may be able to enumerate the room's members, including their display names.
The unauthorized user must be on the same homeserver as a user who is a member of the target room.
Fixed by [52c7a51cf](https://github.com/matrix-org/synapse/commit/52c7a51cf).
- **[GHSA-jj53-8fmw-f2w2](https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2) / [CVE-2021-39163](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39163): Disclosing a private room's name, avatar, topic, and number of members.**
If an unauthorized user knows the Room ID of a private room, then its name, avatar, topic, and number of members may be disclosed through Group / Community features.
The unauthorized user must be on the same homeserver as a user who is a member of the target room, and their homeserver must allow non-administrators to create groups (`enable_group_creation` in the Synapse configuration; off by default).
Fixed by [cb35df940a](https://github.com/matrix-org/synapse/commit/cb35df940a), [\#10723](https://github.com/matrix-org/synapse/issues/10723).
Bugfixes
--------
- Fix a regression introduced in Synapse 1.41 which broke email transmission on systems using older versions of the Twisted library. ([\#10713](https://github.com/matrix-org/synapse/issues/10713))
2021-09-02 17:43:22 +01:00
..
2021-06-24 14:33:20 +01:00
2021-08-17 11:57:58 +00:00
2021-04-14 15:34:27 +01:00
2021-08-17 10:23:14 +00:00
2021-06-02 16:37:59 +01:00
2021-08-17 11:57:58 +00:00
2021-08-31 14:53:42 +01:00
2021-09-02 17:43:22 +01:00
2021-09-01 11:34:56 +01:00
2021-04-20 14:55:16 +01:00
2021-08-17 11:57:58 +00:00
2021-09-01 12:18:18 +01:00
2021-08-17 11:57:58 +00:00
2021-09-02 17:43:22 +01:00
2021-09-02 10:49:07 +01:00
2021-04-14 15:34:27 +01:00
2021-08-17 11:57:58 +00:00
2021-07-26 12:17:00 -04:00
2021-09-02 11:06:45 +01:00
2021-07-13 11:52:58 +01:00
2021-07-13 11:52:58 +01:00
2021-04-14 15:34:27 +01:00
2021-08-27 16:33:41 +01:00
2021-04-14 15:34:27 +01:00
2021-08-09 10:46:39 +02:00
2021-08-06 13:54:23 +01:00
2021-08-17 11:57:58 +00:00
2021-04-14 15:34:27 +01:00
2021-04-14 15:34:27 +01:00
2021-07-27 17:29:42 +00:00
2021-04-23 19:20:44 +01:00
2021-07-16 18:11:53 +02:00
2021-08-17 11:57:58 +00:00
2021-04-14 15:34:27 +01:00
2021-09-01 11:26:23 +01:00
2021-04-14 15:34:27 +01:00
2021-07-19 16:11:34 +01:00
2021-09-01 11:34:56 +01:00