Vulnerability · Published Apr 12, 2021 · Assigned by GitHub_M
CVE-2021-21394Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Medium 5.3
In plain English
A medium-severity improper input validation in synapse from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | matrix-synapse | 1.28.0-1 | DEBIAN-CVE-2021-21394 |
| PyPI | matrix-synapse | 1.28.0 | GHSA-w9fg-xffh-p362 |
| PyPI | matrix-synapse | 1.28.0 | PYSEC-2021-27 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | synapse | < 1.28.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362 x_refsource_CONFIRM
- https://pypi.org/project/matrix-synapse/ x_refsource_MISC
- https://github.com/matrix-org/synapse/pull/9321 x_refsource_MISC
- https://github.com/matrix-org/synapse/pull/9393 x_refsource_MISC
- FEDORA-2021-a627cfd31e vendor-advisory, x_refsource_FEDORA