22 lines
1.2 KiB
Markdown
22 lines
1.2 KiB
Markdown
+++
|
|
title = "Pre-disclosure: upcoming security release of Synapse 1.47.1"
|
|
path = "/blog/2021/11/18/pre-disclosure-upcoming-security-release-of-synapse-1-47-1"
|
|
|
|
[taxonomies]
|
|
author = ["Matrix Security Team"]
|
|
category = ["Security"]
|
|
+++
|
|
|
|
On **Tuesday, 23rd November** we plan to release Synapse 1.47.1 at 12:00 UTC to address a single high severity issue. This vulnerability was discovered internally by our security team. Synapse is a Matrix homeserver implementation developed by the matrix.org team and the wider Matrix community.
|
|
|
|
|
|
If you're a server administrator running Synapse, **please be prepared to upgrade as soon as the patched version is released**.
|
|
|
|
We will be reaching out to downstream packagers to ensure they can prepare patched versions of affected packages at the time of the release. The details of the vulnerability will be disclosed in a blog post on the day of the release. There is so far no evidence of the vulnerability being exploited in the wild.
|
|
|
|
Thank you for your patience while we work to resolve this issue.
|
|
|
|
_Edit, 2021-11-19: The opening paragraph was amended to note that the vulnerability was discovered internally._
|
|
|
|
_Edit, 2021-11-22: The opening paragraph was amended to include a release time of 12:00 UTC._
|