CVE-2021-21274

Katalog CVE

CVSS 6.5 · Medium EPSS 2,2%

Kerentanan Uncontrolled Resource Consumption pada matrix synapse, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6 patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/pull/8950 patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8 patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/releases/tag/v1.25.0 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM...