要点
- CVE-2021-29471 は matrix-synapse, synapse (matrix) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 76.5% より高い）。
- 対処：1.33.2 以降に更新してください。
概要
Impact
"Push rules" can specify conditions under which they will match, including event_match, which matches event content against a pattern including wildcards.
Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.
Patches
The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c.
Workarounds
A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
For more information
If you have any questions or comments about this advisory, email us at [email protected].
NVD の説明
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン