cvelistv5 - CVE-2022-41952

CVE-2022-41952

Vulnerability from cvelistv5

Published

2022-11-22 00:00

Modified

2024-08-03 12:56

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

Uncontrolled Resource Consumption in Matrix Synapse

References

URL	Tags
security-advisories@github.com	https://github.com/matrix-org/synapse/pull/11784	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/matrix-org/synapse/pull/11936	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/matrix-org/synapse/releases/tag/v1.52.0	Release Notes, Third Party Advisory
security-advisories@github.com	https://github.com/matrix-org/synapse/releases/tag/v1.53.0	Release Notes, Third Party Advisory
security-advisories@github.com	https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h	Mitigation, Third Party Advisory

Impacted products

Vendor

Product

Version

▼

matrix-org

synapse

Version: < 1.53.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/pull/11784"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/pull/11936"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/releases/tag/v1.52.0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/releases/tag/v1.53.0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "synapse",
          "vendor": "matrix-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.53.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-22T00:00:00",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h"
        },
        {
          "url": "https://github.com/matrix-org/synapse/pull/11784"
        },
        {
          "url": "https://github.com/matrix-org/synapse/pull/11936"
        },
        {
          "url": "https://github.com/matrix-org/synapse/releases/tag/v1.52.0"
        },
        {
          "url": "https://github.com/matrix-org/synapse/releases/tag/v1.53.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4822-jvwx-w47h",
        "discovery": "UNKNOWN"
      },
      "title": "Uncontrolled Resource Consumption in Matrix Synapse "
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41952",
    "datePublished": "2022-11-22T00:00:00",
    "dateReserved": "2022-09-30T00:00:00",
    "dateUpdated": "2024-08-03T12:56:38.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-41952\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-11-22T16:15:10.960\",\"lastModified\":\"2023-07-06T13:37:54.033\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.\"},{\"lang\":\"es\",\"value\":\"Synapse anterior a 1.52.0 con la funci\u00f3n de vista previa de URL habilitada intentar\u00e1 generar vistas previas de URL para las URL de transmisi\u00f3n de medios sin limitar adecuadamente el tiempo de conexi\u00f3n. Las conexiones solo finalizar\u00e1n despu\u00e9s de que se hayan descargado `max_spider_size` (predeterminado: 10 M), lo que en algunos casos puede llevar a conexiones de larga duraci\u00f3n hacia el servidor de transmisi\u00f3n de medios (por ejemplo, Icecast). Esto puede causar tr\u00e1fico y conexiones excesivos hacia dichos servidores si su URL de transmisi\u00f3n se publica, por ejemplo, en una sala grande con muchas instancias de Synapse con la vista previa de URL habilitada. La versi\u00f3n 1.52.0 implementa un mecanismo de tiempo de espera que finalizar\u00e1 las conexiones de vista previa de URL despu\u00e9s de 30 segundos. Dado que no se admite la generaci\u00f3n de vistas previas de URL para transmisiones multimedia y siempre falla, 1.53.0 implementa adicionalmente una lista de permitidos para tipos de contenido para los cuales Synapse incluso intentar\u00e1 generar una vista previa de URL. Actualice a 1.53.0 para resolver completamente el problema. Como workaround, desactive la funci\u00f3n de vista previa de URL configurando `url_preview_enabled: false` en el archivo de configuraci\u00f3n de Synapse.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-772\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.53.0\",\"matchCriteriaId\":\"33271739-56A1-4395-9C73-983AE397D217\"}]}]}],\"references\":[{\"url\":\"https://github.com/matrix-org/synapse/pull/11784\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/matrix-org/synapse/pull/11936\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/matrix-org/synapse/releases/tag/v1.52.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/matrix-org/synapse/releases/tag/v1.53.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2022-41952

Vulnerability from cvelistv5

gsd-2022-41952

Vulnerability from gsd

ghsa-4822-jvwx-w47h

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature