GitHub Advisoryadvisory · PyPI

GHSA-2hwx-mjrm-v3g8 Denial of service attack via .well-known lookups

MEDIUM Published 2021-03-01 Modified 2024-09-30 Official page ↗
Aliases
CVE-2021-21274
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2021-03-01

Affected packages

• PyPI matrix-synapse: >= 0.99.0, < 1.25.0 → fixed in 1.25.0

Description

Impact A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Patches Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108. Workarounds The `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

Related

Alias · CVE (1)

  • CVE-2021-21274 Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References