GitHub Advisoryadvisory · Go

GHSA-x462-89pf-6r5h Crash due to malformed relay protocol message

LOW Published 2021-05-21 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-21404
Ecosystem
Go
Packages
github.com/syncthing/syncthing
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2021-05-20

Affected packages

• Go github.com/syncthing/syncthing: < 1.15.0 → fixed in 1.15.0

Description

Impact 1. `syncthing` can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field. 2. The relay server `strelaysrv` can be caused to crash and exit if sent a malformed relay protocol message with a negative length field. At no point is sensitive data exposed or liable to be altered due to this issue. Sensitive data is never exposed to relay operators. Syncthing itself would need to be lured to connect to a malicious relay server in order to exploit the issue. Patches Fixed in version 1.15.0. Workarounds 1. No known workaround for `strelaysrv`. 2. `syncthing` can be configured to not use relays, or to only use specific, trusted relays. If Syncthing is used in a closed environment or with relaying disabled, i.e., it does not communicate with unknown relays, Syncthing is not vulnerable. For more information If you have any questions or comments about this advisory, please discuss it on the forum. Thanks to Wojciech Paciorek for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2021-21404 Syncthing is a continuous file synchronization program. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References