UBUNTU-CVE-2021-21274

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-21274

    UBUNTU-CVE-2021-21274

    Published: 26 Feb 2021Last Modified: 8 Sept 2025
    Upstream:
    CVE-2021-21274

    Summary:

    Details: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

    References: https://ubuntu.com/security/CVE-2021-21274, https://github.com/matrix-org/synapse/security/advisories/GHSA-2hwx-mjrm-v3g8, https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6, https://github.com/matrix-org/synapse/pull/8950, https://github.com/matrix-org/synapse/releases/tag/v1.25.0, https://www.cve.org/CVERecord?id=CVE-2021-21274

    Affected packages

    Package

    Name: matrix-synapse

    Purl: pkg:deb/ubuntu/[email protected]+dfsg-1ubuntu0.1~esm4?arch=source&distro=esm-apps/bionic

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.19.2+dfsg-6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-21274 | CVE-DB