GitHub Advisoryadvisory · PyPI

GHSA-vmcc-4p4x-x7wg Matrix Synapse DoS

HIGH Published 2022-05-14 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-10657
Ecosystem
PyPI
Packages
matrix-synapse
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2023-07-25

Affected packages

• PyPI matrix-synapse: < 0.28.1 → fixed in 0.28.1

Description

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to `federation/federation_base.py` and `handlers/message.py`, as exploited in the wild in April 2018.

Related

Alias · CVE (1)

  • CVE-2018-10657 Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References