CVE-2021-29471
Denial of service in Matrix Synapse
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
Synapse es un servidor doméstico de referencia de Matrix escrito en python (paquete pypi matrix-synapse). Matrix es un ecosistema para VoIP y mensajería instantánea federada abierta. En Synapse versiones anteriores a 1.33.2, unas "Push rules" pueden especificar condiciones bajo las cuales coincidirán, incluyendo "event_match", que compara el contenido del evento con un patrón que incluye comodines. Determinados patrones pueden causar un rendimiento muy deficiente en el motor de coincidencia, conllevando a una denegación de servicio cuando se procesan eventos de duración moderada. El problema está parcheado en versión 1.33.2. Una posible solución alternativa podría ser impedir a unos usuarios crear reglas de inserción personalizadas, al bloquear dichas peticiones en un proxy inverso
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-03-30 CVE Reserved
- 2021-05-11 CVE Published
- 2024-01-25 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-331: Insufficient Entropy
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://github.com/matrix-org/synapse/releases/tag/v1.33.2 | Release Notes |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Matrix Search vendor "Matrix" | Synapse Search vendor "Matrix" for product "Synapse" | < 1.33.2 Search vendor "Matrix" for product "Synapse" and version " < 1.33.2" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
|