Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-4MP3-385R-V63F
HistoryNov 24, 2020 - 10:58 p.m.

Denial of service attack due to invalid JSON

2020-11-2422:58:58
CWE-20
GitHub Advisory Database
github.com
43
denial of service
invalid json
matrix clients
synapse
event
room state
patches
upgrading.

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.007

Percentile

80.5%

JSON

Impact

A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.

Patches

At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.

Workarounds

There are no known workarounds.

Upgrading notes

If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.

Affected configurations

Vulners
Node
matrixsynapseRange<1.20.0
VendorProductVersionCPE
matrixsynapse*cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*

Related

debiancve 1
osv 3
prion 1
openvas 6
nessus 2
nvd 1
fedora 6
veracode 1
alpinelinux 1
cve 1
archlinux 1
ubuntucve 1
cvelist 1
debiancve
debiancve
CVE-2020-26890
2020-11-24 03:15:13
osv
osv
Denial of service attack due to invalid JSON
2020-11-24 22:58:58
PYSEC-2020-237
2020-11-24 03:15:00
CVE-2020-26890
2020-11-24 03:15:13
prion
prion
Code injection
2020-11-24 03:15:00
openvas
openvas
Fedora: Security Advisory for matrix-synapse (FEDORA-2020-2578d943d2)
2020-12-10 00:00:00
Fedora: Security Advisory for python-canonicaljson (FEDORA-2020-b90dac7fc4)
2020-12-10 00:00:00
Fedora: Security Advisory for python-authlib (FEDORA-2020-b90dac7fc4)
2020-12-10 00:00:00
nessus
nessus
Fedora 33 : matrix-synapse / python-canonicaljson (2020-2578d943d2)
2020-12-10 00:00:00
Fedora 32 : matrix-synapse / python-authlib / python-canonicaljson / etc (2020-b90dac7fc4)
2020-12-10 00:00:00
nvd
nvd
CVE-2020-26890
2020-11-24 03:15:13
fedora
fedora
[SECURITY] Fedora 32 Update: python-authlib-0.14.3-1.fc32
2020-12-10 01:27:43
[SECURITY] Fedora 32 Update: python-signedjson-1.1.1-3.fc32
2020-12-10 01:27:44
[SECURITY] Fedora 33 Update: python-canonicaljson-1.4.0-1.fc33
2020-12-10 01:16:09
veracode
veracode
Denial Of Service (DoS)
2020-11-26 07:47:46
alpinelinux
alpinelinux
CVE-2020-26890
2020-11-24 03:15:13
cve
cve
CVE-2020-26890
2020-11-24 03:15:13
archlinux
archlinux
[ASA-202011-23] matrix-synapse: denial of service
2020-11-26 00:00:00
ubuntucve
ubuntucve
CVE-2020-26890
2020-11-24 00:00:00
cvelist
cvelist
CVE-2020-26890
2020-11-24 02:07:06

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.007

Percentile

80.5%

JSON
Related for GHSA-4MP3-385R-V63F
debiancve1osv3prion1openvas6nessus2nvd1fedora6veracode1alpinelinux1cve1archlinux1ubuntucve1cvelist1