Vulnerability Description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Matrix | Synapse | < 1.28.0 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://github.com/matrix-org/synapse/pull/9321PatchThird Party Advisory
- https://github.com/matrix-org/synapse/pull/9393PatchThird Party Advisory
- https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://pypi.org/project/matrix-synapse/ProductThird Party Advisory
- https://github.com/matrix-org/synapse/pull/9321PatchThird Party Advisory
- https://github.com/matrix-org/synapse/pull/9393PatchThird Party Advisory
- https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://pypi.org/project/matrix-synapse/ProductThird Party Advisory
FAQ
What is CVE-2021-21394?
CVE-2021-21394 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse...
How severe is CVE-2021-21394?
CVE-2021-21394 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21394?
Check the references section above for vendor advisories and patch information. Affected products include: Matrix Synapse, Fedoraproject Fedora.