CVE-2021-29471 – matrix-synapse

Package

Manager: pip
Name: matrix-synapse
Vulnerable Version: >=0 <1.33.2

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00611 pctl0.68842

Details

Denial of service attack via push rule patterns in matrix-synapse ### Impact "Push rules" can specify [conditions](https://matrix.org/docs/spec/client_server/r0.6.1#conditions) under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. ### Patches The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c. ### Workarounds A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. ### For more information If you have any questions or comments about this advisory, email us at security@matrix.org.

Metadata

Created: 2021-05-13T20:22:51Z
Modified: 2024-09-30T20:43:40Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-x345-32rc-8h85/GHSA-x345-32rc-8h85.json
CWE IDs: ["CWE-331", "CWE-400"]
Alternative ID: GHSA-x345-32rc-8h85
Finding: F002
Auto approve: 1