CVE-2021-29430

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.
Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*

History

03 Aug 2022, 10:13

Type Values Removed Values Added
CWE CWE-20
CWE-400
CWE-770

22 Apr 2021, 17:19

Type Values Removed Values Added
CPE cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 5.0
v3 : 7.5
References (MISC) https://github.com/matrix-org/sydent/commit/0523511d2fb40f2738f8a8549868f44b96e5dab7 - (MISC) https://github.com/matrix-org/sydent/commit/0523511d2fb40f2738f8a8549868f44b96e5dab7 - Patch, Third Party Advisory
References (MISC) https://github.com/matrix-org/sydent/commit/89071a1a754c69a50deac89e6bb74002d4cda19d - (MISC) https://github.com/matrix-org/sydent/commit/89071a1a754c69a50deac89e6bb74002d4cda19d - Patch, Third Party Advisory
References (MISC) https://github.com/matrix-org/sydent/releases/tag/v2.3.0 - (MISC) https://github.com/matrix-org/sydent/releases/tag/v2.3.0 - Release Notes, Third Party Advisory
References (MISC) https://github.com/matrix-org/sydent/commit/f56eee315b6c44fdd9f6aa785cc2ec744a594428 - (MISC) https://github.com/matrix-org/sydent/commit/f56eee315b6c44fdd9f6aa785cc2ec744a594428 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9 - (CONFIRM) https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9 - Patch, Third Party Advisory
References (MISC) https://pypi.org/project/matrix-sydent/ - (MISC) https://pypi.org/project/matrix-sydent/ - Product, Third Party Advisory

15 Apr 2021, 21:18

Type Values Removed Values Added
New CVE

Information

Published : 2021-04-15 21:15

Updated : 2023-12-10 13:55


NVD link : CVE-2021-29430

Mitre link : CVE-2021-29430

CVE.ORG link : CVE-2021-29430


JSON object : View

Products Affected

matrix

  • sydent
CWE
CWE-770

Allocation of Resources Without Limits or Throttling

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption