Bug 258187

Summary:

net-im/py-matrix-synapse: Update to 1.41.1

Product:

Ports & Packages

Reporter:

Sascha Biberhofer <ports>

Component:

Individual Port(s)

Assignee:

Ashish SHUKLA <ashish>

Status:

Closed FIXED

Severity:

Affects Many People

CC:

ashish, ports-secteam, ports

Priority:

Normal

Keywords:

needs-qa, security

Version:

Latest

Flags:

ashish: maintainer-feedback+
ashish: merge-quarterly+

Hardware:

Any

OS:

Any

URL:

https://github.com/matrix-org/synapse/releases/tag/v1.41.1

Attachments:

Description	Flags
net-im/py-matrix-synapse: Update to 1.41.1	ports: maintainer-approval+
security/vuxml diff	none

Description Sascha Biberhofer 2021-08-31 19:48:46 UTC

Created attachment 227574 [details]
net-im/py-matrix-synapse: Update to 1.41.1

The attached patch is a simple version bump to update net-im/py-matrix-synapse to 1.41.1. This release contains fixes for two vulnerabilities [1], [2], which may expose room metadata and membership information to unauthorized users. The vulnerability affects all versions of net-im/py-matrix-synapse prior to 1.41.1.

portlint: "OK" (3 Warnings, none new)
testport: OK (poudriere: 130amd64)
do-test: OK (Ran 1789 tests in 854.478s, PASSED (skips=36, successes=1753))

I've been running the resulting package in production for the past few hours and things look fine, so I don't expect any fallout here. This should probably also be merged back to quarterly, if possible. I'll also try and write a vuxml entry tomorrow.

[1] https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
[2] https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2

Comment 1 Kubilay Kocak freebsd_committer

2021-09-01 01:01:07 UTC

^Triage: Needs VuXML entry

Comment 2 Ashish SHUKLA freebsd_committer

2021-09-02 14:22:47 UTC

Created attachment 227608 [details]
security/vuxml diff

Once port passes testing, I'll commit the security/vuxml update as well.

Comment 3 commit-hook freebsd_committer

2021-09-02 14:38:50 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=1d034041502f6783f8259b91b23e650c79fc4f6d

commit 1d034041502f6783f8259b91b23e650c79fc4f6d
Author:     Ashish SHUKLA <ashish@FreeBSD.org>
AuthorDate: 2021-09-02 14:31:26 +0000
Commit:     Ashish SHUKLA <ashish@FreeBSD.org>
CommitDate: 2021-09-02 14:31:26 +0000

    security/vuxml: Document py-matrix-synapse vulnerabilities

    PR:             258187
    Reported by:    Sascha Biberhofer <ports@skyforge.at>
    Security:       a67e358c-0bf6-11ec-875e-901b0e9408dc
    Security:       CVE-2021-39163
    Security:       CVE-2021-39164

 security/vuxml/vuln-2021.xml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

Comment 4 commit-hook freebsd_committer

2021-09-02 14:46:53 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=1e1181ab180470952c0eacda07094da95c6404f9

commit 1e1181ab180470952c0eacda07094da95c6404f9
Author:     Sascha Biberhofer <ports@skyforge.at>
AuthorDate: 2021-09-02 14:40:41 +0000
Commit:     Ashish SHUKLA <ashish@FreeBSD.org>
CommitDate: 2021-09-02 14:45:52 +0000

    net-im/py-matrix-synapse: Update to 1.41.1

    This release also fixes two security vulnerabilities

    PR:             258187
    MFH:            2021Q3
    Security:       a67e358c-0bf6-11ec-875e-901b0e9408dc
    Security:       CVE-2021-39163
    Security:       CVE-2021-39164

 net-im/py-matrix-synapse/Makefile | 2 +-
 net-im/py-matrix-synapse/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

Comment 5 commit-hook freebsd_committer

2021-09-02 14:52:54 UTC

A commit in branch 2021Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=c14c6de1be8ebad12bc3a43c23b489d85528f334

commit c14c6de1be8ebad12bc3a43c23b489d85528f334
Author:     Sascha Biberhofer <ports@skyforge.at>
AuthorDate: 2021-09-02 14:40:41 +0000
Commit:     Ashish SHUKLA <ashish@FreeBSD.org>
CommitDate: 2021-09-02 14:51:06 +0000

    net-im/py-matrix-synapse: Update to 1.41.1

    This release also fixes two security vulnerabilities

    PR:             258187
    MFH:            2021Q3
    Security:       a67e358c-0bf6-11ec-875e-901b0e9408dc
    Security:       CVE-2021-39163
    Security:       CVE-2021-39164

    (cherry picked from commit 1e1181ab180470952c0eacda07094da95c6404f9)

 net-im/py-matrix-synapse/Makefile | 2 +-
 net-im/py-matrix-synapse/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

Comment 6 Ashish SHUKLA freebsd_committer

2021-09-02 14:56:06 UTC

Committed, thanks!

P.S. Toggled maintainer-feedback to "+" since submitter is maintainer, and their patch is already good