ASA-202011-4 log original external raw

[ASA-202011-4] matrix-synapse: cross-site scripting
Arch Linux Security Advisory ASA-202011-4 ========================================= Severity: High Date : 2020-11-03 CVE-ID : CVE-2020-26891 Package : matrix-synapse Type : cross-site scripting Remote : Yes Link : Summary ======= The package matrix-synapse before version 1.21.0-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "matrix-synapse>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== None. Description =========== A security issue has been found in matrix-synapse before 1.21.0, where HTML pages served via Synapse were vulnerable to cross-site scripting (XSS) attacks. Impact ====== A remote attacker might be able to spoof content and execute code via a cross-site scripting attack. References ==========