GitHub Advisoryadvisory · PyPI

GHSA-rfq8-j7rh-8hf2 Synapse allows unsupported content types to lead to memory exhaustion

HIGH Published 2024-12-03 Modified 2024-12-03 Official page ↗
Aliases
CVE-2024-52805
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-770
Reviewed
2024-12-03

Affected packages

• PyPI matrix-synapse: < 1.120.1 → fixed in 1.120.1

Description

Impact In Synapse before 1.120.1, `multipart/form-data` requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Patches Synapse 1.120.1 resolves the issue by denying requests with unsupported `multipart/form-data` content type. Workarounds Limiting request sizes or blocking the `multipart/form-data` content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low `max_upload_size` in Synapse. References • https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 • https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609 For more information If you have any questions or comments about this advisory, please email us at security at element.io.

Related

Alias · CVE (1)

  • CVE-2024-52805 Synapse is an open-source Matrix homeserver. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References