mirror of
https://github.com/element-hq/synapse
synced 2024-08-19 06:50:52 +00:00
Merge branch 'master' into develop
This commit is contained in:
commit
2414178ed6
2 changed files with 23 additions and 2 deletions
23
CHANGES.rst
23
CHANGES.rst
|
@ -1,5 +1,26 @@
|
||||||
|
Changes in synapse v0.28.1 (2018-05-01)
|
||||||
|
=======================================
|
||||||
|
|
||||||
|
SECURITY UPDATE
|
||||||
|
|
||||||
|
* Clamp the allowed values of event depth received over federation to be
|
||||||
|
[0, 2**63 - 1]. This mitigates an attack where malicious events
|
||||||
|
injected with depth = 2**63 - 1 render rooms unusable. Depth is used to
|
||||||
|
determine the cosmetic ordering of events within a room, and so the ordering
|
||||||
|
of events in such a room will default to using stream_ordering rather than depth
|
||||||
|
(topological_ordering).
|
||||||
|
|
||||||
|
This is a temporary solution to mitigate abuse in the wild, whilst a long solution
|
||||||
|
is being implemented to improve how the depth parameter is used.
|
||||||
|
|
||||||
|
Full details at
|
||||||
|
https://docs.google.com/document/d/1I3fi2S-XnpO45qrpCsowZv8P8dHcNZ4fsBsbOW7KABI/edit#
|
||||||
|
|
||||||
|
* Pin Twisted to <18.4 until we stop using the private _OpenSSLECCurve API.
|
||||||
|
|
||||||
|
|
||||||
Changes in synapse v0.28.0 (2018-04-26)
|
Changes in synapse v0.28.0 (2018-04-26)
|
||||||
===========================================
|
=======================================
|
||||||
|
|
||||||
Bug Fixes:
|
Bug Fixes:
|
||||||
|
|
||||||
|
|
|
@ -16,4 +16,4 @@
|
||||||
""" This is a reference implementation of a Matrix home server.
|
""" This is a reference implementation of a Matrix home server.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
__version__ = "0.28.0"
|
__version__ = "0.28.1"
|
||||||
|
|
Loading…
Reference in a new issue