Bug 1096833 - (CVE-2018-12291) VUL-0: CVE-2018-12291: matrix-synapse: event visibility rules not applied correctly
VUL-0: CVE-2018-12291: matrix-synapse: event visibility rules not applied cor...
: 1096832 (view as bug list)
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.0
Other Other
: P3 - Medium : Normal (vote)
: ---
Assigned To: Security Team bot
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2018-06-10 15:14 UTC by Andreas Stieger
Modified: 2022-11-24 14:25 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2018-06-10 15:14:34 UTC
from https://github.com/matrix-org/synapse/releases/tag/v0.31.1

Changes in synapse v0.31.1 (2018-06-08)

v0.31.1 fixes a security bug in the get_missing_events federation API
where event visibility rules were not applied correctly.

We are not aware of it being actively exploited but please upgrade asap.

Bug Fixes:

    Fix event filtering in get_missing_events handler (PR #3371)

Comment 1 Andreas Stieger 2018-06-11 13:37:12 UTC
*** Bug 1096832 has been marked as a duplicate of this bug. ***
Comment 2 Andreas Stieger 2018-06-11 13:48:22 UTC
to backport, run osc mbranch matrix-synapse, and apply the following patch:

Comment 3 Oliver Kurz 2018-06-13 11:57:23 UTC
Comment 4 Oliver Kurz 2018-06-13 12:00:08 UTC
I meant https://build.opensuse.org/request/show/616522 (with the patch file)
Comment 5 Oliver Kurz 2018-06-13 12:10:38 UTC
back to security then according to astieger
Comment 6 Karol Babioch 2018-06-13 13:33:44 UTC
CVE-2018-12291 was assigned to this.
Comment 7 Swamp Workflow Management 2018-06-20 19:10:53 UTC
openSUSE-SU-2018:1767-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1096833
CVE References: CVE-2018-12291
Sources used:
openSUSE Leap 15.0 (src):    matrix-synapse-0.28.1-lp150.2.4.1, matrix-synapse-test-0.28.1-lp150.2.4.1
Comment 8 Marcus Meissner 2018-07-09 15:17:40 UTC
Comment 9 OBSbugzilla Bot 2022-11-24 14:25:03 UTC
This is an autogenerated message for OBS integration:
This bug (1096833) was mentioned in
https://build.opensuse.org/request/show/1037916 Backports:SLE-15-SP4 / matrix-synapse