CVE-2021-21393

Advisory

Synapse 1.28.0 includes a fix for CVE-2021-21393. Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.
https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21393
• https://github.com/matrix-org/synapse/pull/9321
• https://pypi.org/project/matrix-synapse/
• https://github.com/matrix-org/synapse/pull/9393
• https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88
• https://lists.fedoraproject.org/archives/list/[email protected]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/