Denial of service attack via .well-known lookups
CVE-2021-21274

4.3MEDIUM

Key Information:

Vendor

Matrix-org

Status
Synapse
Vendor
CVE Published:
26 February 2021

What is CVE-2021-21274?

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the federation_domain_whitelist setting can be used to restrict the homeservers communicated with over federation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

synapse >=0.99.0, < 1.25.0

References

https://github.com/matrix-org/synapse/security/advisories...
x_refsource_CONFIRM
https://github.com/matrix-org/synapse/releases/tag/v1.25.0
x_refsource_MISC
https://github.com/matrix-org/synapse/pull/8950
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.