Bugzilla – Bug 1096833
VUL-0: CVE-2018-12291: matrix-synapse: event visibility rules not applied correctly
Last modified: 2022-11-24 14:25:03 UTC
from https://github.com/matrix-org/synapse/releases/tag/v0.31.1 Changes in synapse v0.31.1 (2018-06-08) v0.31.1 fixes a security bug in the get_missing_events federation API where event visibility rules were not applied correctly. We are not aware of it being actively exploited but please upgrade asap. Bug Fixes: Fix event filtering in get_missing_events handler (PR #3371) https://github.com/matrix-org/synapse/commit/ad9edd1d968f19dd4d7c65102fe552076ca9bc5a
*** Bug 1096832 has been marked as a duplicate of this bug. ***
to backport, run osc mbranch matrix-synapse, and apply the following patch: https://github.com/matrix-org/synapse/pull/3371/commits/0834b49c6a9b6c597a154d4b2dfcf8fff90699ec
https://build.opensuse.org/request/show/616521
I meant https://build.opensuse.org/request/show/616522 (with the patch file)
back to security then according to astieger
CVE-2018-12291 was assigned to this.
openSUSE-SU-2018:1767-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1096833 CVE References: CVE-2018-12291 Sources used: openSUSE Leap 15.0 (src): matrix-synapse-0.28.1-lp150.2.4.1, matrix-synapse-test-0.28.1-lp150.2.4.1
released
This is an autogenerated message for OBS integration: This bug (1096833) was mentioned in https://build.opensuse.org/request/show/1037916 Backports:SLE-15-SP4 / matrix-synapse