Vulnetix
Try Vulnetix Request Demo
CVE-2021-29471 PUBLISHED

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

EPSS 0.61% · 69.6th percentile

Risk Scores

EPSS Score
0.61%
69.6th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:22.04:LTSmatrix-synapse1.39.0-1, 1.47.0-2, 1.47.1-1
Ubuntu:Pro:18.04:LTSmatrix-synapse0, 0.24.0+dfsg-1, 0.24.0+dfsg-1ubuntu0.1~esm4
Ubuntu:Pro:20.04:LTSmatrix-synapse0, 1.3.0-1, 1.5.0-1

Timeline

References

Open in Interactive Console →