Attachment 208680 Details for Bug 241574 – vuxml entry for the new net-im/py-matrix-synapse security issue

[patch] vuxml entry for the new net-im/py-matrix-synapse security issue

vuxml.patch (text/plain), 1.44 KB, created by Sascha Biberhofer on 2019-10-29 18:04:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sascha Biberhofer

Created: 2019-10-29 18:04:17 UTC

Size: 1.44 KB

patch

obsolete

>diff -Naur vuxml.orig/vuln.xml vuxml/vuln.xml
>--- vuxml.orig/vuln.xml	2019-10-24 17:08:53.000000000 +0000
>+++ vuxml/vuln.xml	2019-10-29 17:41:18.540791000 +0000
>@@ -58,6 +58,35 @@
>   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+  <vuln vid="42675046-fa70-11e9-ba4e-901b0e934d69">
>+    <topic>py-matrix-synapse -- missing signature checks on some federation APIs</topic>
>+    <affects>
>+      <package>
>+	<name>py35-matrix-synapse</name>
>+	<name>py36-matrix-synapse</name>
>+	<name>py37-matrix-synapse</name>
>+	<range><lt>1.5.0</lt></range>
>+      </package>
>+    </affects>
>+    <description>
>+      <body xmlns="http://www.w3.org/1999/xhtml">
>+	<p>Matrix developers report:</p>
>+	<blockquote cite="https://github.com/matrix-org/synapse/pull/6262">
>+	  <p>Make sure that [...] events sent over /send_join, /send_leave, and
>+	  /invite, are correctly signed and come from the expected servers.</p>
>+	</blockquote>
>+      </body>
>+    </description>
>+    <references>
>+      <url>https://github.com/matrix-org/synapse/pull/6262</url>
>+      <url>https://github.com/matrix-org/synapse/releases/tag/v1.5.0</url>
>+    </references>
>+    <dates>
>+      <discovery>2019-10-29</discovery>
>+      <entry>2019-10-29</entry>
>+    </dates>
>+  </vuln>
>+
>   <vuln vid="53b3474c-f680-11e9-a87f-a4badb2f4699">
>     <topic>FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat</topic>
>     <affects>

Actions: View | Diff

Attachments on bug 241574: 208679 | 208680 | 209510 | 209511