Update ghcr.io/element-hq/synapse Docker tag to v1.112.0 #295
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "renovate/ghcr.io-element-hq-synapse-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v1.111.0->v1.112.0Release Notes
element-hq/synapse (ghcr.io/element-hq/synapse)
v1.112.0Compare Source
Synapse 1.112.0 (2024-07-30)
This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.
Note that this security fix is also available as Synapse 1.111.1, which does not include the rest of the changes in Synapse 1.112.0.
This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request.
If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.
With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected.
The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.
Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.
pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using
pip install Twisted==24.7.0rc1. Note also that even the--upgrade-strategy=eagerflag topip install -U matrix-synapsewill not upgrade Twisted to a patched version because it is only a release candidate at this time.Internal Changes
Synapse 1.112.0rc1 (2024-07-23)
Please note that this release candidate does not include the security dependency update
included in version 1.111.1 as this version was released before 1.111.1.
The same security fix can be found in the full release of 1.112.0.
Features
/syncendpoint. (#17416)name/avatarfields in experimental MSC3575 Sliding Sync/syncendpoint. (#17418)heroesand room summary fields (joined_count,invited_count) in experimental MSC3575 Sliding Sync/syncendpoint. (#17419)is_dmroom field in experimental MSC3575 Sliding Sync/syncendpoint. (#17429)/syncendpoint. (#17432)/syncendpoint. (#17454)Bugfixes
/syncendpoint when using room type filters and the user has one or more remote invites. (#17434)heroesbystream_orderingas the Matrix specification states (applies to/sync). (#17435)/syncwould break for a user when using workers with multiple stream writers. (#17438)Improved Documentation
default_power_level_content_overrideconfig option. (#17451)Internal Changes
RateLimiter.record_action. (#17426)/syncendpoint to bump room when it is created. (#17453)get_rooms_for_local_user_where_membership_isto speed up sliding sync. (#17460)$MEas a state key in sliding sync. (#17469)Updates to locked dependencies
v1.111.1Compare Source
Synapse 1.111.1 (2024-07-30)
This security release is to update our locked dependency on Twisted to 24.7.0rc1, which includes a security fix for CVE-2024-41671 / GHSA-c8m8-j448-xjx7: Disordered HTTP pipeline response in twisted.web, again.
This issue means that, if multiple HTTP requests are pipelined in the same TCP connection, Synapse can send responses to the wrong HTTP request.
If a reverse proxy was configured to use HTTP pipelining, this could result in responses being sent to the wrong user, severely harming confidentiality.
With that said, despite being a high severity issue, we consider it unlikely that Synapse installations will be affected.
The use of HTTP pipelining in this fashion would cause worse performance for clients (request-response latencies would be increased as users' responses would be artificially blocked behind other users' slow requests). Further, Nginx and Haproxy, two common reverse proxies, do not appear to support configuring their upstreams to use HTTP pipelining and thus would not be affected. For both of these reasons, we consider it unlikely that a Synapse deployment would be set up in such a configuration.
Despite that, we cannot rule out that some installations may exist with this unusual setup and so we are releasing this security update today.
pip users: Note that by default, upgrading Synapse using pip will not automatically upgrade Twisted. Please manually install the new version of Twisted using
pip install Twisted==24.7.0rc1. Note also that even the--upgrade-strategy=eagerflag topip install -U matrix-synapsewill not upgrade Twisted to a patched version because it is only a release candidate at this time.Internal Changes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.