Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint

published 2021-05-19 5y ago modified 2024-12-02 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches The issue is fixed by https://github.com/matrix-org/synapse/pull/9855.

### Workarounds There are no known workarounds.

### References n/a

### For more information If you have any questions or comments about this advisory, email us at security@matrix.org.

Patch / fix

fixed in 1 links 1

pypi matrix-synapse 1.33.0

github.com/matrix-org/synapse#9855 pull request

Is GHSA-7h5v-85w9-pq6c in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	matrix-synapse	<1.33.0	1.33.0

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

Sources

GitHub Advisory GHSA-7h5v-85w9-pq6c

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.