Vulnerability Description
matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in file size, but large in complexity. A malicious user could upload a relatively small image in terms of file size, using particular image formats, which expands to have extremely large dimensions during the process of thumbnailing. The server can be exhausted of memory in the process of trying to load the whole image into memory for thumbnailing, leading to denial of service. Version 1.2.7 has a fix for the vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Matrix-Media-Repo Project | Matrix-Media-Repo | < 1.2.7 |
Related Weaknesses (CWE)
References
- https://github.com/turt2live/matrix-media-repo/releases/tag/v1.2.7Release NotesThird Party Advisory
- https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-j889-h47PatchThird Party Advisory
- https://hub.docker.com/r/turt2live/matrix-media-repo/tags?page=1&ordering=last_uThird Party Advisory
- https://github.com/turt2live/matrix-media-repo/releases/tag/v1.2.7Release NotesThird Party Advisory
- https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-j889-h47PatchThird Party Advisory
- https://hub.docker.com/r/turt2live/matrix-media-repo/tags?page=1&ordering=last_uThird Party Advisory
FAQ
What is CVE-2021-29453?
CVE-2021-29453 is a vulnerability with a CVSS score of 5.7 (MEDIUM). matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in f...
How severe is CVE-2021-29453?
CVE-2021-29453 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29453?
Check the references section above for vendor advisories and patch information. Affected products include: Matrix-Media-Repo Project Matrix-Media-Repo.