CVE Vulnerability

CVE-2021-21394

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/matrix-org/synapse/pull/9321 Patch Third Party Advisory
https://pypi.org/project/matrix-synapse/ Product Third Party Advisory
https://github.com/matrix-org/synapse/pull/9393 Patch Third Party Advisory
https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362 Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/ Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Information

Published : 2021-04-12 09:15

Updated : 2021-11-23 10:36

NVD link : CVE-2021-21394

Mitre link : CVE-2021-21394

Products Affected
No products.
CWE
CWE-20