CVE-2022-41952

{"id": "CVE-2022-41952", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2022-11-22T16:15:10.960", "references": [{"url": "https://github.com/matrix-org/synapse/pull/11784", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/synapse/pull/11936", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/synapse/releases/tag/v1.52.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/synapse/releases/tag/v1.53.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-772"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file."}, {"lang": "es", "value": "Synapse anterior a 1.52.0 con la funci\u00f3n de vista previa de URL habilitada intentar\u00e1 generar vistas previas de URL para las URL de transmisi\u00f3n de medios sin limitar adecuadamente el tiempo de conexi\u00f3n. Las conexiones solo finalizar\u00e1n despu\u00e9s de que se hayan descargado `max_spider_size` (predeterminado: 10 M), lo que en algunos casos puede llevar a conexiones de larga duraci\u00f3n hacia el servidor de transmisi\u00f3n de medios (por ejemplo, Icecast). Esto puede causar tr\u00e1fico y conexiones excesivos hacia dichos servidores si su URL de transmisi\u00f3n se publica, por ejemplo, en una sala grande con muchas instancias de Synapse con la vista previa de URL habilitada. La versi\u00f3n 1.52.0 implementa un mecanismo de tiempo de espera que finalizar\u00e1 las conexiones de vista previa de URL despu\u00e9s de 30 segundos. Dado que no se admite la generaci\u00f3n de vistas previas de URL para transmisiones multimedia y siempre falla, 1.53.0 implementa adicionalmente una lista de permitidos para tipos de contenido para los cuales Synapse incluso intentar\u00e1 generar una vista previa de URL. Actualice a 1.53.0 para resolver completamente el problema. Como workaround, desactive la funci\u00f3n de vista previa de URL configurando `url_preview_enabled: false` en el archivo de configuraci\u00f3n de Synapse."}], "lastModified": "2023-07-06T13:37:54.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33271739-56A1-4395-9C73-983AE397D217", "versionEndExcluding": "1.53.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}