Skip to content
OpenAdvisories
Low · 3.7 CVE-2021-29471 EUVD-2021-0127GHSA-x345-32rc-8h85PYSEC-2021-135

Denial of service in Matrix Synapse

Published May 11, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

Affected products

VendorProductAffectedFixed
matrix-org synapse < 1.33.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS matrix-synapse No fix yet —
Ubuntu Pro 20.04 LTS matrix-synapse No fix yet —
Ubuntu Pro 18.04 LTS matrix-synapse No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed matrix-synapse 1.43.0-1.1 openSUSE-SU-2024:11041-1
ReleasePackageFixed inAdvisory
Alpine v3.24 synapse 1.33.2-r0 —
Alpine v3.23 synapse 1.33.2-r0 —
Alpine v3.22 synapse 1.33.2-r0 —
Alpine v3.21 synapse 1.33.2-r0 —
Alpine v3.20 synapse 1.33.2-r0 —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 synapse 1.33.2-r0 —
Alpine v3.18 synapse 1.33.2-r0 —
Alpine v3.17 synapse 1.33.2-r0 —
Alpine v3.16 synapse 1.33.2-r0 —
Alpine v3.15 synapse 1.33.2-r0 —
Alpine v3.14 synapse 1.33.2-r0 —
Alpine v3.13 synapse 1.34.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI matrix-synapse < 1.33.2 1.33.2 GHSA-x345-32rc-8h85

Advisories 1

References