Accepted matrix-synapse 1.47.1-1 (source) into unstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 23 Nov 2021 13:17:43 +0100
Source: matrix-synapse
Architecture: source
Version: 1.47.1-1
Distribution: unstable
Urgency: high
Maintainer: Matrix Packaging Team <pkg-matrix-maintainers@lists.alioth.debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Changes:
matrix-synapse (1.47.1-1) unstable; urgency=high
.
* New upstream security release.
* CVE-2021-41281: Path traversal when downloading remote media:
Synapse instances with the media repository enabled can be tricked
into downloading a file from a remote server into an arbitrary
directory, potentially outside the media store directory.
Homeservers with the media repository disabled or configured with a
federation whitelist are unaffected.
(GHSA-3hfw-x7gx-437c)
Checksums-Sha1:
3ff700e121bbb6cd2214bb512f35ed271554c633 2428 matrix-synapse_1.47.1-1.dsc
7d683830d7cae54228345361ee4009ef03c3f1fb 7566339 matrix-synapse_1.47.1.orig.tar.gz
26797e9701d4f4c24e0717c51e1499a9cd2788b0 108812 matrix-synapse_1.47.1-1.debian.tar.xz
Checksums-Sha256:
0be1532e4f6466e7518dc4a7189c39910f0577c9d00a87420d3ea4fd395fe086 2428 matrix-synapse_1.47.1-1.dsc
cc385b6cfeba671bba800c2557ad39063bdd53f70dfb3781c85df7af6f5d064c 7566339 matrix-synapse_1.47.1.orig.tar.gz
f5383f3a2da63ecc4b75f00a666c33468d62804c9712d0cf90472330b9ffb907 108812 matrix-synapse_1.47.1-1.debian.tar.xz
Files:
a9a031b83af73d4b70ac20234c6b0ee2 2428 net optional matrix-synapse_1.47.1-1.dsc
e0924c9eeb87e311f7694e87a26cbc30 7566339 net optional matrix-synapse_1.47.1.orig.tar.gz
149eb378001527a3a0db787bc7151f2b 108812 net optional matrix-synapse_1.47.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCYZzcXQAKCRDoRGtKyMdy
YYusAQDN7r6m+pvcI51XbCjj9twSRs6zYGEDOFAy6ljRkM8gzAD/cHyQ2LOGIVJw
iiTtx4HYj8lf9Zhq9udDOE1/xAEphQ4=
=1Ik+
-----END PGP SIGNATURE-----