CVE-2021-29471: fedoraproject fedora Uncontrolled Resource Consumption

Vulnerability summary

CVE-2021-29471 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in fedoraproject fedora. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities.

Timeline

1. 11-05-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-331Insufficient EntropyThe product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.