Bug 2026127 - CVE-2021-41281: remote overwrite vulnerability in <= 1.47.0
Summary: CVE-2021-41281: remote overwrite vulnerability in <= 1.47.0
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: matrix-synapse
Version: rawhide
Hardware: All
OS: All
unspecified
urgent
Target Milestone: ---
Assignee: Dan Callaghan
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 2027230 (view as bug list)
Depends On:
Blocks: CVE-2021-41281
TreeView+ depends on / blocked
 
Reported: 2021-11-23 20:03 UTC by customercare
Modified: 2022-03-06 09:16 UTC (History)
4 users (show)

Fixed In Version: matrix-synapse-1.48.0-1.fc35 matrix-synapse-1.48.0-1.fc34
Clone Of:
Environment:
Last Closed: 2021-12-09 01:11:41 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description customercare 2021-11-23 20:03:46 UTC
Today we are releasing Synapse 1.47.1, a security update based on last week's release of Synapse 1.47.0. This release patches one high severity issue affecting Synapse installations 1.47.0 and earlier using the media repository. An attacker could cause these Synapses to download a remote file and store it in a directory outside the media repository.

Note that:

    This only affects homeservers using Synapse's built-in media repository, as opposed to synapse-s3-storage-provider or matrix-media-repo.
    Attackers cannot control the exact name or destination of the stored file.

To quote from the advisory:

GHSA-3hfw-x7gx-437c / CVE-2021-41281: Path traversal when downloading remote media.

    Impact

    Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

    The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.

    Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

The advisory has full details, including workarounds.

This issue was discovered and fixed by our internal security team.

Please update at your earliest convenience.

Comment 1 Fedora Update System 2021-11-24 11:15:58 UTC
FEDORA-2021-39a23c1aa0 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-39a23c1aa0

Comment 2 Fedora Update System 2021-11-24 11:19:34 UTC
FEDORA-2021-4878d3d55b has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2021-4878d3d55b

Comment 3 Fedora Update System 2021-11-25 20:16:57 UTC
FEDORA-2021-4878d3d55b has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-4878d3d55b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-4878d3d55b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2021-11-25 20:16:59 UTC
FEDORA-2021-39a23c1aa0 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-39a23c1aa0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-39a23c1aa0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2021-12-01 01:37:11 UTC
FEDORA-2021-9758549fce has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-9758549fce`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-9758549fce

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2021-12-01 01:56:33 UTC
FEDORA-2021-2f9dcdbace has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-2f9dcdbace`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-2f9dcdbace

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2021-12-09 01:11:41 UTC
FEDORA-2021-9758549fce has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2021-12-09 01:35:04 UTC
FEDORA-2021-2f9dcdbace has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Dan Callaghan 2022-03-06 09:16:24 UTC
*** Bug 2027230 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.