Skip to content
Snippets Groups Projects
Select Git revision
  • tedomum default
  • deploy-exploding-state-groups
  • fix-exploding-state-groups
  • v1.127.1+tedomum.1
  • v1.125.0+tedomum.1
  • v1.123.0+tedomum.1
  • v1.122.0+tedomum.1
  • v1.121.1+tedomum.1
  • v1.119.0+tedomum.1
  • v1.118.0+tedomum.1
  • v1.114.0+tedomum.1
  • v1.109.0+tedomum.1
  • v1.105.1+tedomum.1
  • v1.98.0+tedomum.1
  • v1.97.0+tedomum.1
  • v1.96.1+tedomum.1
  • v1.95.1+tedomum.1
  • v1.88.0+tedomum.1
  • v1.73.0
  • v1.73.0rc2
  • v1.73.0rc1
  • v1.72.0
  • v1.72.0rc1
23 results
Blame Permalink
To find the state of this project's repository at the time of any of these versions, check out the tags.
CHANGES.md 328.19 KiB

Next version

  • Two new templates (sso_auth_confirm.html and sso_account_deactivated.html) were added to Synapse. If your Synapse is configured to use SSO and a custom sso_redirect_confirm_template_dir configuration then these templates will need to be duplicated into that directory.

  • Plugins using the complete_sso_login method of synapse.module_api.ModuleApi should update to using the async/await version complete_sso_login_async which includes additional checks. The non-async version is considered deprecated.

Synapse 1.12.3 (2020-04-03)

  • Remove the the pin to Pillow 7.0 which was introduced in Synapse 1.12.2, and correctly fix the issue with building the Debian packages. (#7212)

Synapse 1.12.2 (2020-04-02)

This release works around an issue with building the debian packages.

No other significant changes since 1.12.1.

Synapse 1.12.1 (2020-04-02)

No significant changes since 1.12.1rc1.

Synapse 1.12.1rc1 (2020-03-31)

Bugfixes

  • Fix starting workers when federation sending not split out. (#7133). Introduced in v1.12.0.
  • Avoid importing sqlite3 when using the postgres backend. Contributed by David Vo. (#7155). Introduced in v1.12.0rc1.
  • Fix a bug which could cause outbound federation traffic to stop working if a client uploaded an incorrect e2e device signature. (#7177). Introduced in v1.11.0.

Synapse 1.12.0 (2020-03-23)

No significant changes since 1.12.0rc1.

Debian packages and Docker images are rebuilt using the latest versions of dependency libraries, including Twisted 20.3.0. Please see security advisory below.

Security advisory

Synapse may be vulnerable to request-smuggling attacks when it is used with a reverse-proxy. The vulnerabilties are fixed in Twisted 20.3.0, and are described in CVE-2020-10108 and CVE-2020-10109. For a good introduction to this class of request-smuggling attacks, see https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn.

We are not aware of these vulnerabilities being exploited in the wild, and do not believe that they are exploitable with current versions of any reverse proxies. Nevertheless, we recommend that all Synapse administrators ensure that they have the latest versions of the Twisted library to ensure that their installation remains secure.

  • Administrators using the matrix.org Docker image or the Debian/Ubuntu packages from matrix.org should ensure that they have version 1.12.0 installed: these images include Twisted 20.3.0.
  • Administrators who have installed Synapse from source should upgrade Twisted within their virtualenv by running: 
    <path_to_virtualenv>/bin/pip install 'Twisted>=20.3.0'
  • Administrators who have installed Synapse from distribution packages should consult the information from their distributions.

The matrix.org Synapse instance was not vulnerable to these vulnerabilities.