CVE-2021-29471: Denial of service in Matrix Synapse
Impact
"Push rules" can specify conditions under which they will match, including eventmatch, which matches event content against a pattern including wildcards.
Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.
Patches
The issue is patched by https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c.
Workarounds
A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
For more information
If you have any questions or comments about this advisory, email us at security@matrix.org.
Other sources
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including eventmatch, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/matrix-synapseto a version that resolves this vulnerability.Fixed in 1.33.2 - Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.34.0-r0 - Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.33.2-r0 - Upgrade
Upgrade
matrix-synapseto a version that resolves this vulnerability.Fixed in 1.33.2 - Compensating control
Block requests for users making custom push rules at a reverse proxy.
Event History
Frequently Asked Questions
What is CVE-2021-29471?
CVE-2021-29471 is a vulnerability in the Synapse Matrix reference homeserver that allows "Push rules" to match events under certain conditions.
What is the severity of CVE-2021-29471?
CVE-2021-29471 has a severity rating of 5.3 (medium).
Which software is affected by CVE-2021-29471?
The Matrix Synapse version up to 1.33.2 and Fedoraproject Fedora version 34 are affected by CVE-2021-29471.
How can I fix CVE-2021-29471?
To fix CVE-2021-29471, upgrade to Synapse version 1.33.2 or later.
Where can I find more information about CVE-2021-29471?
You can find more information about CVE-2021-29471 in the references provided: [Link 1](https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332a977d226c), [Link 2](https://github.com/matrix-org/synapse/releases/tag/v1.33.2), [Link 3](https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h85).