PT-2021-14472 · Synapse+1 · Synapse+1

Richvdh · Published 2021-02-25 · Updated 2021-11-23 · CVE-2021-21393

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0

Description The issue is related to missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could cause excessive use of disk space and memory leading to resource exhaustion. This affects the groups feature, also known as communities, which is not part of the Matrix specification. The chosen maximum lengths are arbitrary, and not all clients might abide by them.

Recommendations For versions prior to 1.28.0, consider disabling the groups feature by setting enable group creation to False to mitigate this issue. Note that the groups feature is disabled by default. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is fixed by updating to version 1.28.0 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2021-1402

CVE-2021-21393

GHSA-JRH7-MHHX-6H88

PYSEC-2021-26

Affected Products

Alt Linux

Synapse

References · 22

• https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88 · Patch
• https://github.com/matrix-org/synapse/pull/9321 · Patch
• https://github.com/matrix-org/synapse/pull/9393 · Patch
• https://osv.dev/vulnerability/CVE-2021-21393 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21393 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21393 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21393 · Security Note
• https://osv.dev/vulnerability/GHSA-jrh7-mhhx-6h88 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21393 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21393 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21393 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://github.com/matrix-org/synapse/commit/3f58fc848d0002de4605bed91603a1f9f245d128 · Note