svn commit: r549530 - head/security/vuxml
Danilo G. Baio
dbaio at FreeBSD.org
Mon Sep 21 21:07:57 UTC 2020
Author: dbaio
Date: Mon Sep 21 21:07:56 2020
New Revision: 549530
URL: https://svnweb.freebsd.org/changeset/ports/549530
Log:
security/vuxml: Document net-im/py-matrix-synapse issue
PR: 249375
Submitted by: Denis Kasak <dkasak at termina.org.uk>
Submitted by: Sascha Biberhofer <ports at skyforge.at> (earlier version)
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Mon Sep 21 20:29:28 2020 (r549529)
+++ head/security/vuxml/vuln.xml Mon Sep 21 21:07:56 2020 (r549530)
@@ -58,6 +58,39 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="2327234d-fc4b-11ea-adef-641c67a117d8">
+ <topic>py-matrix-synapse -- malformed events may prevent users from joining federated rooms</topic>
+ <affects>
+ <package>
+ <name>py36-matrix-synapse</name>
+ <name>py37-matrix-synapse</name>
+ <name>py38-matrix-synapse</name>
+ <range><lt>1.19.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <h1>Problem Description:</h1>
+ <p>Affected Synapse versions assume that all events have an "origin" field set. If an event
+ without the "origin" field is sent into a federated room, servers not already joined to
+ the room will be unable to do so due to failing to fetch the malformed event.</p>
+ <h1>Impact:</h1>
+ <p>An attacker could cause a denial of service by deliberately sending a malformed event
+ into a room, thus preventing new servers (and thus their users) from joining the
+ room.</p>
+ </body>
+ </description>
+ <references>
+ <url>https://github.com/matrix-org/synapse/issues/8319</url>
+ <url>https://github.com/matrix-org/synapse/pull/8324</url>
+ <url>https://github.com/matrix-org/synapse/blob/v1.19.3/CHANGES.md</url>
+ </references>
+ <dates>
+ <discovery>2020-09-16</discovery>
+ <entry>2020-09-21</entry>
+ </dates>
+ </vuln>
+
<vuln vid="2cb21232-fb32-11ea-a929-a4bf014bf5f7">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list