PYSEC-2021-132

    Dashboard / Vulnerabilities / PYSEC-2021-132

    PYSEC-2021-132

    Published: 26 Feb 2021Last Modified: 8 Nov 2023

    Summary:

    Details: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

    References: https://github.com/matrix-org/synapse/releases/tag/v1.25.0, https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6, https://github.com/matrix-org/synapse/pull/8950, https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8

    Affected packages

    Package

    Name: matrix-synapse

    Purl: pkg:pypi/matrix-synapse

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ff5c4da1289cb5e097902b3e55b771be342c29d6

    Affected versions

    0.99.0
    0.99.1
    0.99.1.1
    0.99.1rc1
    0.99.1rc2
    0.99.2
    0.99.2rc1
    0.99.3
    0.99.3.1
    0.99.3.2
    0.99.3rc1
    0.99.4
    0.99.4rc1
    0.99.5
    0.99.5.1
    0.99.5.2
    0.99.5rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2021-132 | CVE-DB