GitHub Advisoryadvisory · PyPI

GHSA-w9fg-xffh-p362 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

MEDIUM Published 2021-04-13 Modified 2024-09-24 Official page ↗
Aliases
CVE-2021-21394
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2021-04-12

Affected packages

• PyPI matrix-synapse: < 1.28.0 → fixed in 1.28.0

Description

Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Patches The issue is fixed by #9321. Workarounds Depending on the needs and configuration of the homeserver a few options are available: 1. Using email as third-party identifiers be disabled by not configuring the `email` setting. 2. Using phone numbers as third-party identifiers can be disabled by ensuring that `account_threepid_delegates.msisdn` is not configured. 3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy: • `^/_matrix/client/(r0|unstable)/register/email` • `^/_matrix/client/(r0|unstable)/register/msisdn` • `^/_matrix/client/(r0|unstable)/account/password` • `^/_matrix/client/(r0|unstable)/account/3pid`

Related

Alias · CVE (1)

  • CVE-2021-21394 Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References