GitHub Advisoryadvisory · PyPI
GHSA-pw4v-gr34-2553 Sydent DoS (via resource exhaustion) due to improper input validation
MEDIUM
Official page ↗
- Aliases
- CVE-2021-29433
- Ecosystem
- PyPI
- Packages
- matrix-sydent
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-20, CWE-400
- Reviewed
- 2021-04-15
Affected packages
• PyPI matrix-sydent: < 2.3.0 → fixed in 2.3.0
Description
Impact
Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.
Patches
Fixed by 3175fd3.
For more information
If you have any questions or comments about this advisory, email us at [email protected].
Related
Alias · CVE (1)
- CVE-2021-29433 Sydent is a reference Matrix identity server. vulnerability
References
- https://github.com/matrix-org/sydent/security/advisories/GHSA-pw4v-gr34-2553 web
- https://nvd.nist.gov/vuln/detail/CVE-2021-29433 advisory
- https://github.com/matrix-org/sydent/commit/3175fd358ebc2c310eab7a3dbf296ce2bd54c1da web
- https://github.com/matrix-org/sydent package
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2021-24.yaml web
- https://pypi.org/project/matrix-sydent web