CVE-2021-29430— Matrix Sydent 资源管理错误漏洞

Denial of service attack via memory exhaustion

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

输入验证不恰当

Matrix Sydent 资源管理错误漏洞

Matrix Sydent是英国Matrix.org基金会的一款Matrix身份验证服务器API的实现。 Sydent 存在资源管理错误漏洞，该漏洞导致内存耗尽和拒绝服务。

N/A

N/A