Bug 2209892 - CVE-2022-39374,CVE-2022-39335,CVE-2023-32323: Updates to 1.74 are required on all fedora versions [NEEDINFO]
Summary: CVE-2022-39374,CVE-2022-39335,CVE-2023-32323: Updates to 1.74 are required on...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: matrix-synapse
Version: 38
Hardware: All
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Dan Callaghan
QA Contact: Fedora Extras Quality Assurance
URL: https://matrix.org/blog/2023/05/24/di...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-25 07:28 UTC by customercare
Modified: 2023-08-15 09:15 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:
V02460: needinfo? (zebob.m)
cheimes: needinfo-
V02460: needinfo? (zebob.m)


Attachments (Terms of Use)

Description customercare 2023-05-25 07:28:29 UTC
Disclosing Synapse security advisories
2023-05-24 — Security — Denis Kasak (dkasak)

Today we are retroactively publishing advisories for security bugs in Synapse. From oldest to most recent, they are:

    GHSA-p9qp-c452-f9r7 (CVE-2022-39374), fixed in Synapse 1.68.0 and affecting all prior versions since Synapse 1.62.0;
    GHSA-45cj-f97f-ggwv (CVE-2022-39335), fixed in Synapse 1.69.0 and affecting all prior versions; and finally
    GHSA-f3wc-3vxv-xmvr (CVE-2023-32323), fixed in Synapse 1.74.0 and affecting all prior versions.

We strongly advise Synapse operators who are still on earlier Synapse versions to upgrade to the latest version (v1.84.0) or at the very least v1.74.0 (released Dec 2022), to prevent attacks based on these vulnerabilities. Please see the advisories for the full details, including a description of

    the vulnerability and potential attacks,
    exactly which deployments are vulnerable, and
    workarounds and mitigations.

Because these bugs are either related to or exploitable over Matrix federation, we have delayed publishing these advisories until now out of caution. This allowed us to ensure that the majority of Synapse homeservers across the public federation have upgraded to a sufficiently patched version, based on the (opt-in) stats reporting to the Matrix.org foundation.

If you have any questions or comments about this announcement or any of the advisories, e-mail us at security.

Reproducible: Always

Comment 2 customercare 2023-05-25 07:55:11 UTC
Emerg Workaround for F37:

$ dnf update matrix-synapse --releasever=38

Comment 3 Kai A. Hiller 2023-05-25 08:32:21 UTC
Properly updating Synapse in F37 requires newer versions of python-twisted and python-setuptools-rust (,and optionally a newer version of py-icu for user search). I am currently figuring out if cherry-picking the fixes is an alternative.

Comment 4 Kai A. Hiller 2023-05-26 14:31:40 UTC
I backported the fix for CVE-2022-39335 to F37. The fixes for CVE-2022-39374[1] and CVE-2023-32323[2] don’t apply cleanly. I will not be able to address those in a timely manner as I am gone the next days. For reference, I have a copr[3] for matrix-synapse that runs on F37.

@The maintainers of python-twisted and python-setuptools-rust: Is an update of your packages possible for F37?

[1] https://github.com/matrix-org/synapse/pull/14642
[2] https://github.com/matrix-org/synapse/pull/13723
[3] https://copr.fedorainfracloud.org/coprs/v02460/matrix-synapse

Comment 5 Christian Heimes 2023-05-30 07:28:46 UTC
An update of python-setuptools-rust is possible but time consuming. I may have to coordinate with other packagers to update its dependencies on F37. Is 1.5.2 (rawhide) recent enough or would you need latest upstream 1.6.0?

Comment 6 Kai A. Hiller 2023-06-01 15:10:26 UTC
@cheimes Updating to python-setuptools-rust version 1.5.2 is recent enough. Although it only makes sense if python-twisted is updated as well.

@zebob.m Is it feasible to update python-twisted to 22.10 (from 22.04) in F37?

Comment 7 Christian Heimes 2023-08-14 04:10:12 UTC
python-setuptools-rust has been updated to 1.6.0 in all supported versions of Fedora, #2190299.


Note You need to log in before you can comment on or make changes to this bug.