ALT-PU-2024-3315: package matrix-synapse update to version 1.101.0-alt1
Описание
This update upgrades matrix-synapse to version 1.101.0-alt1.
Устраненные уязвимости5
Ссылки5
GHSA-4f74-84v3-j9q5
https://github.com/advisories/GHSA-4f74-84v3-j9q5GHSA-5chr-wjw5-3gq4
https://github.com/advisories/GHSA-5chr-wjw5-3gq4GHSA-7565-cq32-vx2x
https://github.com/advisories/GHSA-7565-cq32-vx2xGHSA-mp92-3jfm-3575
https://github.com/advisories/GHSA-mp92-3jfm-3575Связанные уязвимости
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
Synapse is an open-source Matrix homeserver written and maintained by ...
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.