CVE-2021-29430 Denial of service attack via memory exhaustion
Attackers can cause denial of service in Sydent by sending oversized HTTP requests or responses, exhausting server memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29430?
CVE-2021-29430 is a high-severity denial of service vulnerability in matrix-org sydent, published on 15 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.
Which versions are affected by CVE-2021-29430?
3 open source packages ship an affected version, including matrix-sydent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-sydent PyPI | All versions | 2.3.0 |
matrix-sydent PyPI | All versions | 2.3.0 |
matrix-sydent PyPI | All versions | 2.3.0 |
Products include Matrix Sydent.
How do I fix CVE-2021-29430?
Upgrade matrix-sydent to 2.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-29430 being exploited?
There is no known exploitation of CVE-2021-29430 in the wild and no public exploit code.
Other vulnerabilities in matrix-org sydent
- CVE-2023-38686 Sydent does not verify email server certificates
- CVE-2021-29431 SSRF in Sydent due to missing validation of hostnames
- CVE-2019-11842 matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
- CVE-2019-11340 Matrix Sydent mishandles emails
- CVE-2021-29432 Malicious users could control the content of invitation emails
Sources
Also known as GHSA-wmg4-8cp2-hpg9, PYSEC-2021-21.