Vulnerability Description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Matrix | Synapse | < 1.33.2 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977PatchThird Party Advisory
- https://github.com/matrix-org/synapse/releases/tag/v1.33.2Release NotesThird Party Advisory
- https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977PatchThird Party Advisory
- https://github.com/matrix-org/synapse/releases/tag/v1.33.2Release NotesThird Party Advisory
- https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2021-29471?
CVE-2021-29471 is a vulnerability with a CVSS score of 3.7 (LOW). Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push r...
How severe is CVE-2021-29471?
CVE-2021-29471 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29471?
Check the references section above for vendor advisories and patch information. Affected products include: Matrix Synapse, Fedoraproject Fedora.