Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an     ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is     missing input validation of some parameters on the endpoints used to confirm third-party identifiers could     cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature     is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients     might abide by them. Refer to referenced GitHub security advisory for additional details including     workarounds. (CVE-2021-21394)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
    ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is
    missing input validation of some parameters on the endpoints used to confirm third-party identifiers could
    cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature
    is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients
    might abide by them. Refer to referenced GitHub security advisory for additional details including
    workarounds. (CVE-2021-21394)

ID	Name	Product	Family	Severity
257707	Linux Distros Unpatched Vulnerability : CVE-2021-21394	Nessus	Misc.	medium
419835	SCA: security update for matrix-synapse (GHSA-w9fg-xffh-p362)	Tenable Cloud Security	SCA Checks	medium
419835	SCA: security update for matrix-synapse (GHSA-w9fg-xffh-p362)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2021-21394

medium

Tenable Plugins

medium

medium

medium