PT-2021-14473

CVE-2021-21394

تاريخ النشر

2021-02-25

تاريخ التحديث

2021-11-23

الوصف من

CVSS 3.1

6.5

متوسطة

المقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0

Description The issue is caused by missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could lead to excessive use of disk space and memory, resulting in resource exhaustion. The affected endpoints include "/ matrix/client/(r0|unstable)/register/email", "/ matrix/client/(r0|unstable)/register/msisdn", "/ matrix/client/(r0|unstable)/account/password", and "/ matrix/client/(r0|unstable)/account/3pid".

Recommendations For versions prior to 1.28.0, consider the following workarounds:

Disable using email as third-party identifiers by not configuring the email setting.
Disable using phone numbers as third-party identifiers by ensuring that account threepid delegates.msisdn is not configured.
Block the affected endpoint patterns at a reverse proxy, including "^/ matrix/client/(r0|unstable)/register/email", "^/ matrix/client/(r0|unstable)/register/msisdn", "^/ matrix/client/(r0|unstable)/account/password", and "^/ matrix/client/(r0|unstable)/account/3pid". Update to version 1.28.0 or later to fix the issue.

قابلية الاستغلال

إصلاح

التأثيرات

الباحثون

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-20: Improper Input Validation

المعرّفات ذات الصلة

CVE-2021-21394

GHSA-W9FG-XFFH-P362

ALT-PU-2021-1402