Arch Linux Security Advisory ASA-202105-19 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29471 Package : matrix-synapse Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1943 Summary ======= The package matrix-synapse before version 1.33.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.33.2-1. # pacman -Syu "matrix-synapse>=1.33.2-1" The problem has been fixed upstream in version 1.33.2. Workaround ========== A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Description =========== In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Impact ====== A remote attacker could cause high CPU usage on the server using crafted push rules, leading to denial of service. References ========== https://bugs.archlinux.org/task/70801 https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h8... https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c332... https://security.archlinux.org/CVE-2021-29471