Veracode Vulnerability DatabaseVERACODE:40769Denial Of Service (DoS)
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.3%
matrix-synapse is vulnerable to Denial Of Service (DoS). The vulnerability exists due to a lack of validation in the invite_room_state, which allows an attacker to generate maliciously large invites and crash the application.
References
github.com/matrix-org/synapse/commit/e2a1adbf5d11288f2134ced1f84c6ffdd91a9357
github.com/matrix-org/synapse/issues/14492
github.com/matrix-org/synapse/pull/14642
github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr
lists.fedoraproject.org/archives/list/[email protected]/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.3%