kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security/vuxml: Document vulnerability for net-im/py-matrix-synapse

Browse source
This commit is contained in:
Ashish SHUKLA 2022-06-29 03:56:40 +00:00
parent aaa201ef81
commit 423a0eb3f3
No known key found for this signature in database
GPG key ID: C746CFA9E74FA4B0
1 changed files with 39 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
security/vuxml/vuln-2022.xml
View file

@ -1,3 +1,42 @@
<vuln vid="07c0d782-f758-11ec-acaa-901b0e9408dc">
<topic>py-matrix-synapse -- unbounded recursion in urlpreview</topic>
<affects>
<package>
<name>py37-matrix-synapse</name>
<name>py38-matrix-synapse</name>
<name>py39-matrix-synapse</name>
<name>py310-matrix-synapse</name>
<name>py311-matrix-synapse</name>
<range><lt>1.61.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1">
<p>This release fixes a vulnerability with Synapse's URL preview feature. URL previews
of some web pages can lead to unbounded recursion, causing the request to either fail,
or in some cases crash the running Synapse process.</p>
<p>Note that:</p>
<ul>
<li>Homeservers with the url_preview_enabled configuration option set to false
(the default value) are unaffected.</li>
<li>Instances with the enable_media_repo configuration option set to false are
also unaffected, as this also disables the URL preview functionality.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-31052</cvename>
<url>https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1</url>
</references>
<dates>
<discovery>2022-06-28</discovery>
<entry>2022-06-29</entry>
</dates>
</vuln>
<vuln vid="ae5722a6-f5f0-11ec-856e-d4c9ef517024">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>