mirror of
https://github.com/element-hq/synapse.git
synced 2024-12-14 11:57:44 +00:00
1.112.0
This commit is contained in:
parent
8b449a8ce6
commit
37f9876ccf
4 changed files with 32 additions and 2 deletions
25
CHANGES.md
25
CHANGES.md
|
@ -1,5 +1,30 @@
|
||||||
|
# Synapse 1.112.0 (2024-07-30)
|
||||||
|
|
||||||
|
This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for [CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again](https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7).
|
||||||
|
|
||||||
|
Note that this security fix is also available as **Synapse 1.111.1**, which does not include the rest of the changes in Synapse 1.112.0.
|
||||||
|
|
||||||
|
This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request.
|
||||||
|
If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.
|
||||||
|
|
||||||
|
With that said, despite being a high severity issue, **we consider it unlikely that Synapse installations will be affected**.
|
||||||
|
The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.
|
||||||
|
|
||||||
|
Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.
|
||||||
|
|
||||||
|
**pip users:** Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. **Please manually install the new version of Twisted** using `pip install Twisted==24.7.0rc1`. Note also that even the `--upgrade-strategy=eager` flag to `pip install -U matrix-synapse` will not upgrade Twisted to a patched version because it is only a release candidate at this time.
|
||||||
|
|
||||||
|
### Internal Changes
|
||||||
|
|
||||||
|
- Upgrade locked dependency on Twisted to 24.7.0rc1. ([\#17502](https://github.com/element-hq/synapse/issues/17502))
|
||||||
|
|
||||||
|
|
||||||
# Synapse 1.112.0rc1 (2024-07-23)
|
# Synapse 1.112.0rc1 (2024-07-23)
|
||||||
|
|
||||||
|
Please note that this release candidate does not include the security dependency update
|
||||||
|
included in version 1.111.1 as this version was released before 1.111.1.
|
||||||
|
The same security fix can be found in the full release of 1.112.0.
|
||||||
|
|
||||||
### Features
|
### Features
|
||||||
|
|
||||||
- Add to-device extension support to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17416](https://github.com/element-hq/synapse/issues/17416))
|
- Add to-device extension support to experimental [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/pull/3575) Sliding Sync `/sync` endpoint. ([\#17416](https://github.com/element-hq/synapse/issues/17416))
|
||||||
|
|
|
@ -1 +0,0 @@
|
||||||
Upgrade locked dependency on Twisted to 24.7.0rc1.
|
|
6
debian/changelog
vendored
6
debian/changelog
vendored
|
@ -1,3 +1,9 @@
|
||||||
|
matrix-synapse-py3 (1.112.0) stable; urgency=medium
|
||||||
|
|
||||||
|
* New Synapse release 1.112.0.
|
||||||
|
|
||||||
|
-- Synapse Packaging team <packages@matrix.org> Tue, 30 Jul 2024 17:15:48 +0100
|
||||||
|
|
||||||
matrix-synapse-py3 (1.112.0~rc1) stable; urgency=medium
|
matrix-synapse-py3 (1.112.0~rc1) stable; urgency=medium
|
||||||
|
|
||||||
* New Synapse release 1.112.0rc1.
|
* New Synapse release 1.112.0rc1.
|
||||||
|
|
|
@ -97,7 +97,7 @@ module-name = "synapse.synapse_rust"
|
||||||
|
|
||||||
[tool.poetry]
|
[tool.poetry]
|
||||||
name = "matrix-synapse"
|
name = "matrix-synapse"
|
||||||
version = "1.112.0rc1"
|
version = "1.112.0"
|
||||||
description = "Homeserver for the Matrix decentralised comms protocol"
|
description = "Homeserver for the Matrix decentralised comms protocol"
|
||||||
authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
|
authors = ["Matrix.org Team and Contributors <packages@matrix.org>"]
|
||||||
license = "AGPL-3.0-or-later"
|
license = "AGPL-3.0-or-later"
|
||||||
|
|
Loading…
Reference in a new issue