[ASA-202105-19] matrix-synapse: denial of service
diabonas at archlinux.org
Wed May 26 10:32:44 UTC 2021
Arch Linux Security Advisory ASA-202105-19
Date : 2021-05-25
CVE-ID : CVE-2021-29471
Package : matrix-synapse
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1943
The package matrix-synapse before version 1.33.2-1 is vulnerable to
denial of service.
Upgrade to 1.33.2-1.
# pacman -Syu "matrix-synapse>=1.33.2-1"
The problem has been fixed upstream in version 1.33.2.
A potential workaround might be to prevent users from making custom
push rules, by blocking such requests at a reverse-proxy.
In Synapse before version 1.33.2 "Push rules" can specify conditions
under which they will match, including `event_match`, which matches
event content against a pattern including wildcards. Certain patterns
can cause very poor performance in the matching engine, leading to a
denial-of-service when processing moderate length events. The issue is
patched in version 1.33.2. A potential workaround might be to prevent
users from making custom push rules, by blocking such requests at a
A remote attacker could cause high CPU usage on the server using
crafted push rules, leading to denial of service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security