Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-4MP3-385R-V63F
HistoryNov 24, 2020 - 10:58 p.m.

Denial of service attack due to invalid JSON

2020-11-2422:58:58
CWE-20
GitHub Advisory Database
github.com
38

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

79.7%

JSON

Impact

A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.

Patches

At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.

Workarounds

There are no known workarounds.

Upgrading notes

If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.

Affected configurations

Vulners
Node
matrixsynapseRange<1.20.0
CPENameOperatorVersion
matrix-synapselt1.20.0

Related

osv 3
prion 1
debiancve 1
openvas 6
fedora 6
veracode 1
alpinelinux 1
nessus 2
nvd 1
archlinux 1
cvelist 1
cve 1
ubuntucve 1
osv
osv
Denial of service attack due to invalid JSON
2020-11-24 22:58:58
CVE-2020-26890
2020-11-24 03:15:13
PYSEC-2020-237
2020-11-24 03:15:00
prion
prion
Code injection
2020-11-24 03:15:00
debiancve
debiancve
CVE-2020-26890
2020-11-24 03:15:13
openvas
openvas
Fedora: Security Advisory for matrix-synapse (FEDORA-2020-2578d943d2)
2020-12-10 00:00:00
Fedora: Security Advisory for python-authlib (FEDORA-2020-b90dac7fc4)
2020-12-10 00:00:00
Fedora: Security Advisory for matrix-synapse (FEDORA-2020-b90dac7fc4)
2020-12-10 00:00:00
fedora
fedora
[SECURITY] Fedora 32 Update: python-authlib-0.14.3-1.fc32
2020-12-10 01:27:43
[SECURITY] Fedora 32 Update: python-signedjson-1.1.1-3.fc32
2020-12-10 01:27:44
[SECURITY] Fedora 33 Update: python-canonicaljson-1.4.0-1.fc33
2020-12-10 01:16:09
veracode
veracode
Denial Of Service (DoS)
2020-11-26 07:47:46
alpinelinux
alpinelinux
CVE-2020-26890
2020-11-24 03:15:13
nessus
nessus
Fedora 33 : matrix-synapse / python-canonicaljson (2020-2578d943d2)
2020-12-10 00:00:00
Fedora 32 : matrix-synapse / python-authlib / python-canonicaljson / etc (2020-b90dac7fc4)
2020-12-10 00:00:00
nvd
nvd
CVE-2020-26890
2020-11-24 03:15:13
archlinux
archlinux
[ASA-202011-23] matrix-synapse: denial of service
2020-11-26 00:00:00
cvelist
cvelist
CVE-2020-26890
2020-11-24 02:07:06
cve
cve
CVE-2020-26890
2020-11-24 03:15:13
ubuntucve
ubuntucve
CVE-2020-26890
2020-11-24 00:00:00

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

79.7%

JSON
Related for GHSA-4MP3-385R-V63F
osv3prion1debiancve1openvas6fedora6veracode1alpinelinux1nessus2nvd1archlinux1cvelist1cve1ubuntucve1