diff -Naur security/vuxml.orig/vuln.xml security/vuxml/vuln.xml --- security/vuxml.orig/vuln.xml 2020-07-02 19:21:57.000000000 +0000 +++ security/vuxml/vuln.xml 2020-07-03 06:41:26.921291000 +0000 @@ -58,6 +58,37 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + py-matrix-synapse -- multiple vulnerabilities + + + py36-matrix-synapse + py37-matrix-synapse + py38-matrix-synapse + 1.15.2 + + + + +

Matrix developers report:

+
Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild.
+
+
A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers.
+
HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade.
+
+

+ + + + https://github.com/matrix-org/synapse/releases/tag/v1.15.2 + + + 2020-07-02 + 2020-07-02 + + + Gitlab -- Multiple Vulnerabilities