Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an     ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 Push rules can     specify conditions under which they will match, including `event_match`, which matches event content     against a pattern including wildcards. Certain patterns can cause very poor performance in the matching     engine, leading to a denial-of-service when processing moderate length events. The issue is patched in     version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by     blocking such requests at a reverse-proxy. (CVE-2021-29471)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
    ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can
    specify conditions under which they will match, including `event_match`, which matches event content
    against a pattern including wildcards. Certain patterns can cause very poor performance in the matching
    engine, leading to a denial-of-service when processing moderate length events. The issue is patched in
    version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by
    blocking such requests at a reverse-proxy. (CVE-2021-29471)

Matrix developers report :

'Push rules' can specify conditions under which they will match, including event_match, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.

ID	Name	Product	Family	Severity
259577	Linux Distros Unpatched Vulnerability : CVE-2021-29471	Nessus	Misc.	medium
420239	SCA: security update for matrix-synapse (GHSA-x345-32rc-8h85)	Tenable Cloud Security	SCA Checks	medium
420239	SCA: security update for matrix-synapse (GHSA-x345-32rc-8h85)	Tenable Self-Hosted Container Security	SCA Checks	medium
407303	Alpine: multiple synapse packages: security update to 1.34.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407303	Alpine: multiple synapse packages: security update to 1.34.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407302	Alpine: multiple synapse packages: security update to 1.33.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407302	Alpine: multiple synapse packages: security update to 1.33.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
149424	FreeBSD : py-matrix-synapse -- malicious push rules may be used for a denial of service attack. (278561d7-b261-11eb-b788-901b0e934d69)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-29471

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium