SB2021071802 - Fedora 34 update for matrix-synapse
Published: July 18, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-21274)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when requesting the .well-known file. A remote attacker can trick a victim to connect a specially crafted homeserver and perform a denial of service (DoS) attack.
2) Open redirect (CVE-ID: CVE-2021-21273)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
3) Cross-site scripting (CVE-ID: CVE-2021-21332)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the password reset endpoint when handling password reset token submission. A remote attacker can send a specially crafted request to execute arbitrary script in the victim's browser.
The impact may include access to cookies and other browser data, CSRF exposure, and access to other resources served on the same domain or parent domains.
4) Cross-site scripting (CVE-ID: CVE-2021-21333)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to inject forged content into notification emails.
The vulnerability exists due to improper neutralization of input during web page generation in email notification templates when rendering missed message notifications. A remote user can send crafted content to inject forged content into notification emails.
The account expiry notification path is also affected, but that injection is not controllable by an attacker.
5) Input validation error (CVE-ID: CVE-2021-21393)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in groups/communities endpoints when handling requests with crafted parameter values. A remote attacker can send specially crafted requests to cause a denial of service.
Exploitation can lead to excessive use of disk space and memory, and clients may have issues rendering large fields.
6) Improper access control (CVE-ID: CVE-2021-21392)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to make the server send requests to internal infrastructure.
The vulnerability exists due to improper access control in outbound request handling when processing user-provided domains with transitional IPv6 addresses on dual-stack networks. A remote attacker can provide a crafted domain that resolves to a transitional IPv6 address to make the server send requests to internal infrastructure.
Outbound requests to federation, identity servers, third-party invite key validity checks, push notifications, and URL preview generation are affected.
7) Input validation error (CVE-ID: CVE-2021-21394)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in third-party identifier confirmation endpoints when handling crafted parameters. A remote attacker can send specially crafted requests to cause a denial of service.
The issue can lead to excessive use of disk space and memory due to resource exhaustion.
8) Resource management error (CVE-ID: CVE-2021-29471)
CWE-ID: CWE-399 - Resource Management Errors
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the push rules implementation. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.