Vulnerability · Published Apr 6, 2021 · Assigned by GitHub_M
CVE-2021-21404Crash due to malformed relay protocol message
High 7.5
In plain English
A high-severity improper input validation in syncthing from syncthing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | syncthing | 1.15.1-r0 | ALPINE-CVE-2021-21404 |
| Alpine:v3.21 | syncthing | 1.15.1-r0 | ALPINE-CVE-2021-21404 |
| Alpine:v3.22 | syncthing | 1.15.1-r0 | ALPINE-CVE-2021-21404 |
| Alpine:v3.23 | syncthing | 1.15.1-r0 | ALPINE-CVE-2021-21404 |
| Alpine:v3.24 | syncthing | 1.15.1-r0 | ALPINE-CVE-2021-21404 |
| Debian:12 | syncthing | 1.12.1~ds1-3 | DEBIAN-CVE-2021-21404 |
| Debian:13 | syncthing | 1.12.1~ds1-3 | DEBIAN-CVE-2021-21404 |
| Debian:14 | syncthing | 1.12.1~ds1-3 | DEBIAN-CVE-2021-21404 |
| Go | github.com/syncthing/syncthing | 1.15.0 | GO-2022-0888 |
| Go | github.com/syncthing/syncthing | 1.15.0 | GHSA-x462-89pf-6r5h |
| Ubuntu:25.10 | syncthing | no fix listed | UBUNTU-CVE-2021-21404 |
| Ubuntu:26.10 | syncthing | no fix listed | UBUNTU-CVE-2021-21404 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h x_refsource_CONFIRM
- https://pkg.go.dev/github.com/syncthing/syncthing x_refsource_MISC
- https://github.com/syncthing/syncthing/commit/fb4fdaf4c0a79c22cad000c42ac1394e3ccb6a97 x_refsource_MISC
- https://github.com/syncthing/syncthing/releases/tag/v1.15.0 x_refsource_MISC