Created attachment 216148 [details] net-im/py-matrix-synapse: 1.14.0 to 1.15.2 The matrix developers have just released synapse 1.15.2 (see [1]), containing security fixes for two vulnerabilities: - A malicious homeserver could force Synapse to reset the state in a room to a small subset of the correct state. This affects all Synapse deployments which federate with untrusted servers. (96e9afe6) - HTML pages served via Synapse were vulnerable to clickjacking attacks. This predominantly affects homeservers with single-sign-on enabled, but all server administrators are encouraged to upgrade. (ea26e9a9) This patch bumps the port to the aforementioned version. It also adds www/py-pyjwt to the test dependencies, which is necessary to make the testsuite pass successfully. portlint: "OK" (4 Warnings, none new) testport: OK (poudriere: 121amd64) do-test: OK (Ran 1063 tests in 327.652s, PASSED (skips=5, successes=1058)) The resulting port also runs fine on my server. Cheers, Sascha [1] https://github.com/matrix-org/synapse/releases/tag/v1.15.2
Created attachment 216149 [details] py-matrix-synapse 1.15.2 vuln.xml entry Here's the vuxml entry for this incident.
Build info is available at https://gitlab.com/swills/freebsd-ports/pipelines/162580406
(In reply to Sascha Biberhofer from comment #1) Is it possible to convert this to a patch against security/vuxml/vuln.xml?
Created attachment 216156 [details] py-matrix-synapse 1.15.2 vuln.xml entry (patch format)
(In reply to Li-Wen Hsu from comment #3) Done. I avoided the patch since vuln.xml changes so rapidly that I wasn't sure a diff would apply cleanly. :)
(In reply to Sascha Biberhofer from comment #5) Thanks, although it might not be able to apply directly but it reduce much time on format editing. :-) Oh, I probably should have asked "vuxml format" which should be easier for both of us. I'll remember that next time.
A commit references this bug: Author: lwhsu Date: Fri Jul 3 07:04:06 UTC 2020 New revision: 541079 URL: https://svnweb.freebsd.org/changeset/ports/541079 Log: Document net-im/py-matrix-synapse security issue before 1.15.2 PR: 247720 Submitted by: Sascha Biberhofer <ports@skyforge.at> Changes: head/security/vuxml/vuln.xml
A commit references this bug: Author: lwhsu Date: Fri Jul 3 07:06:28 UTC 2020 New revision: 541080 URL: https://svnweb.freebsd.org/changeset/ports/541080 Log: Update to 1.15.2 PR: 247720 Submitted by: Sascha Biberhofer <ports@skyforge.at> (maintainer) MFH: 2020Q3 Security: d9f686f3-fde0-48dc-ab0a-01c2fe3e0529 Changes: head/net-im/py-matrix-synapse/Makefile head/net-im/py-matrix-synapse/distinfo
Wait for MFH.
A commit references this bug: Author: lwhsu Date: Sat Jul 4 09:26:59 UTC 2020 New revision: 541183 URL: https://svnweb.freebsd.org/changeset/ports/541183 Log: MFH: r541080 Update to 1.15.2 PR: 247720 Submitted by: Sascha Biberhofer <ports@skyforge.at> (maintainer) Security: d9f686f3-fde0-48dc-ab0a-01c2fe3e0529 Approved by: ports-secteam (joneum) Changes: _U branches/2020Q3/ branches/2020Q3/net-im/py-matrix-synapse/Makefile branches/2020Q3/net-im/py-matrix-synapse/distinfo
^Triage: Track merge