GitHub Advisoryadvisory · PyPI

GHSA-hxmp-pqch-c8mm Denial of service attack via incorrect parameters in Matrix Synapse

HIGH Published 2020-12-09 Modified 2024-09-24 Official page ↗
Aliases
CVE-2020-26257
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-74, CWE-79
Reviewed
2020-12-09

Affected packages

• PyPI matrix-synapse: < 1.23.1 → fixed in 1.23.1

Description

Impact A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. Patches Issue is resolved by https://github.com/matrix-org/synapse/pull/8776. Workarounds Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

Related

Alias · CVE (1)

  • CVE-2020-26257 Matrix is an ecosystem for open federated Instant Messaging and VoIP. vulnerability

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References