In short
- CVE-2021-29471 is a MEDIUM (CVSS 5.3) vulnerability affecting matrix-synapse, synapse (matrix).
- Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.5% of all vulnerabilities.
- Fix: update to 1.33.2 or later.
Description
Impact
"Push rules" can specify conditions under which they will match, including event_match, which matches event content against a pattern including wildcards.
Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.
Patches
The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c.
Workarounds
A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
For more information
If you have any questions or comments about this advisory, email us at [email protected].
NVD description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
More vulnerabilities in matrix-synapse
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free